Incident Management · Topic 1 of 3
Incident Management Architecture
CIS-ITSM Incident Management architecture: the incident table, key fields like Channel and Priority, roles, interfaces, and links to problem and change.
- 5 min
- The incident table extends task, so it inherits assignment, notes, approvals and SLA support.
- Channel records how the incident was reported; it replaced the older Contact type label.
- Priority is not typed in; it is calculated from Impact and Urgency.
What it is
Incident Management restores normal service as quickly as possible after an unplanned interruption or a drop in quality. In ServiceNow every incident is a record on the Incident table, incident.
The incident table extends the Task table, task. That inheritance is the core of the architecture: assignment, work notes, approvals, SLAs and the activity stream all come from task, so incident, problem and change behave in the same way.
How it works
The incident table and inherited fields
Fields such as Number, Assignment group, Assigned to, Short description, Work notes, Additional comments, Active, Impact, Urgency and Priority come from task. Incident adds or relabels its own fields, such as Caller, Category, Subcategory, Channel, On hold reason, Resolution code and Resolution notes.
Because SLAs are defined against task based tables, the same Service Level Management engine times incidents, problem tasks and catalog tasks. This is why a single SLA design can cover several processes.
Key fields an implementer configures
| Field | What it records |
|---|---|
| Caller | The person affected by the incident |
| Category and Subcategory | What kind of issue it is, used for reporting and routing |
| Service, Service offering, Configuration item | What is broken, from the CMDB and service model |
| Channel | How the incident was reported, such as phone, email, chat or self service (older releases called it Contact type) |
| Impact and Urgency | How widely it hurts the business and how fast it must be fixed |
| Priority | Calculated from Impact and Urgency by the priority data lookup |
| Assignment group and Assigned to | Who works on it |
| Work notes and Additional comments | Internal notes versus messages the caller can see |
The Configuration item field is where Incident Management meets the CMDB. Picking the right CI lets the agent see related records, its support group, and what else depends on it.
Roles
| Role | What it allows |
|---|---|
| No role (requester) | Report and view their own incidents through Employee Center or the portal |
| itil | Fulfiller: create, update, work and resolve incidents |
| incident_manager | Oversee the incident process and the records in it |
| admin | Full configuration of the application |
Most service desk agents only need itil. Give elevated roles to process owners, not to every agent.
Interfaces
Requesters use Employee Center (or the Service Portal) to report an issue, check status and add comments. They can also use Virtual Agent or send an email that the inbound email actions turn into an incident.
Agents work incidents in Service Operations Workspace, which shows the record, related items, knowledge and suggested actions in one screen. The classic form in the platform UI shows the same record.
Links to other processes
Incident is the entry point to most of ITSM. The incident form holds reference fields that tie it to other processes.
| Field on incident | Points to |
|---|---|
| Problem | The problem record that is investigating the root cause |
| Change request | A change raised to fix the incident |
| Caused by Change | A change that caused the incident |
| Parent incident | A parent incident that this child is grouped under |
An incident references one problem through its Problem field, and the problem lists all its incidents in a related list. Agents can also search knowledge from the incident and attach an article that solved it.
How the exam asks about this
- "A customer wants agents to see the incident, related knowledge and suggested actions in one screen." Service Operations Workspace.
- "The service desk needs to report how many incidents arrive by phone versus self service." Report on the Channel field.
- "An analyst finds that ten incidents share one underlying cause." Create or link a problem and set the Problem field on each incident.
What to remember for the exam
- The incident table extends task, so it inherits assignment, notes, approvals and SLA support.
- Channel records how the incident was reported; it replaced the older Contact type label.
- Priority is not typed in; it is calculated from Impact and Urgency.
- itil is the fulfiller role; requesters need no role to report their own incidents.
- The CI field links the incident to the CMDB and to the services that depend on that CI.
- An incident points to one problem; a problem can have many incidents.
Work notes are internal and Additional comments are visible to the caller. Choosing Additional comments for a private technical note is a common wrong answer.
Common mistakes
Building a custom incident table. The base incident table already carries the task features the customer needs. A custom table loses inherited SLAs, reporting and integrations.
Giving agents the admin role. Agents work records with itil. Admin is for configuration and should stay with a small team.
Leaving the CI field empty. Without a CI the agent loses impact information, the problem team loses trend data, and change cannot see which incidents a change caused.
Check yourself
Which table does the incident table extend, and why does it matter?
It extends the task table. That gives incidents the same assignment, notes, approval and SLA features as other task records.
What does the Channel field record?
How the incident was reported, such as phone, email, chat or self service. Older releases labeled it Contact type.
How are an incident and a problem linked?
The incident's Problem field references the problem, and the problem shows its incidents in a related list.
Topic 1 of 3 in Incident Management
Test yourself on Incident Management
The full ServiceNow CIS-ITSM question bank has 598 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ServiceNow. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.