Managing a major incident record

  • Release version: Xanadu
  • Updated August 1, 2024
  • 5 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Managing a major incident record

    Managing a major incident record in ServiceNow involves using a structured playbook and multiple tabs within the major incident record page to effectively handle and resolve critical incidents. Agents can propose incidents as major incidents, while major incident managers review, accept, and promote these proposals. Once promoted, the major incident record provides comprehensive information and tools to guide the entire incident management process.

    Show full answer Show less

    Key Features

    • Overview tab: Displays essential incident details such as summary, impact, location, affected configuration items (CIs), probable cause, resolution information, and an activity feed for comments and work notes.
    • Details tab: Offers detailed incident attributes including category, subcategory, assignment group, watch list, and resolution data.
    • Communicate tab: Manages communication tasks to maintain stakeholder engagement throughout the incident lifecycle.
    • Related records tab: Lists associated records like task SLAs and affected CIs, helping track related activities.
    • Playbook tab: Provides access to major incident playbooks that guide agents through standardized workflows for managing major incidents.
    • Contextual side panel: Includes options for launching playbooks, viewing recommended actions, incident record information (such as active calls, caller details, SLAs, and assignment), collaboration tools (calls, chats, on-call experts), and initiating communication via integrated channels like Zoom, Webex, Microsoft Teams, and Slack.
    • Propose and Promote Major Incident: Agents propose potential major incidents; managers review and promote them to active major incidents, enabling full access to management tools.

    Practical Application

    ServiceNow customers can utilize this framework to streamline major incident handling by:

    • Quickly proposing and escalating incidents based on detailed data.
    • Leveraging playbooks for guided, task-oriented workflows that ensure consistent and effective incident resolution.
    • Maintaining clear, organized stakeholder communication through dedicated tabs and collaboration tools.
    • Accessing real-time incident context and collaboration options directly from the record, enhancing responsiveness.
    • Creating problem records directly from major incidents to facilitate root cause analysis and long-term resolution.
    • Reviewing post incident reports to capture lessons learned and prevent recurrence.

    Expected Outcomes

    By following this structured approach, organizations can expect improved major incident management efficiency, better stakeholder communication, faster resolution times, and enhanced post-incident analysis. The integrated tools and playbooks help ensure that major incidents are handled systematically and with full visibility, reducing business impact and supporting continuous service improvement.

    Manage a major incident record with a playbook or the various tabs on the major incident record page.

    Based on the information displayed on different tabs, an agent can propose a major incident using the Propose Major Incident option. A major incident manager reviews the information on the Overview tab, such as the location information, and then accepts or rejects the major incident proposal. After a proposal is accepted, the major incident manager uses the Promote Major Incident option to promote the candidate to a major incident.

    After an incident is promoted to a major incident, each tab on a Major Incident record page contains information about the major incident. You can use the various options and the action menu to manage the major incident process and view incident information on the following:
    • Overview tab
    • Details tab
    • Communicate tab
    • Related tab
    • Playbook tab
    • Contextual side panel
    Overview tab
    The Overview tab displays the incident information in the following sections:
    • Summary – Basic incident information, such as short description, description, impact, urgency, and state.
    • Impact:
      • Impact summary - Impact summary information, such as business impact, configuration item, service, and service offering.
      • Location – The location of the caller on the world map, the number of locations, and the number of users. This information is only displayed for a major incident and if you have the major_incident_manager role.
      • Affected CIs – The number of CIs affected by the incident.
      • Impacted Services/CIs – The number of CIs and services impacted by the incident.
      • Assets – The number of assets associated with the incident.
    • Cause – The probable cause of the incident.
    • Resolution – Incident resolution-related information, such as resolution code and resolution notes, once the incident is resolved.

    On the Activity section, you can view all comments, work notes, actions taken, and composed emails. This section also includes user activities, such as a change in the state and the assignment group. In the Compose section, you can add comments, work notes, and actions taken, as well as compose emails.

    For more information on the Overview tab, see View and update incident information on the Overview tab.

    Details tab
    The Details tab displays detailed information about the incident, such as category, subcategory, impact, related record, assignment group, watch list, cause, and resolution. For more information on the Details tab, see Incident Management in Service Operations Workspace.
    Communicate tab
    The Communicate tab displays the list of communication tasks with various options that are used to maintain communications with the stakeholders for major incidents. For more information on the options available on the Communicate tab, see Communicating with stakeholders about incidents and major incidents.
    Related records tab
    The Related records tab provides a list view of the records associated with the major incident. For example, task SLAs and affected CIs.
    Playbook tab
    The Playbook tab displays the information of the playbooks available for Major Incident Management. For each playbook, you can select to work with the playbook to manage major incidents. For more information, see Managing major incidents using playbooks.
    Contextual side panel options

    On the Contextual side panel, you can use the following options:

    • Major Incident Playbook – Select the Major Incident Playbook (Major incident playbook) icon to launch the playbook side panel. The playbook provides a guided approach to the entire major incident process. It provides a way to visualize business process workflows for major incidents in a simple, task-oriented view. The playbook contains the following two tabs:
      • Current – List of major incident playbooks running currently.
      • History – Historical list of major incident playbooks.
    • Recommended actions – Select the Recommended Actions (Recommended actions for ITSM) icon to launch the View recommendation side panel. The side panel lists all the recommended actions for major incidents. When an incident is promoted to a major incident and doesn’t have a problem record associated with it, this tab displays a card with the Create a problem option to create a problem record.

      You can also configure whether the incident field information is copied automatically when a problem record is created by using the List of attributes (comma-separated) that will be copied from the incident to create a new problem (com.snc.problem.create_from_incident.attributes) system property. For more information, see Create a problem.

    • Record Information – Select the Record information (Record information) icon to view the incident record information on the side panel. The record information side panel includes the following information:
      • Active calls – Details of the active conference calls for major incidents. You can select the call record to start a conference call.
      • Caller details – Name, local time, address, email id, and other caller information. Select the Contact option to view the caller details and caller assets. You can also see recent interactions and incidents with the caller.
      • SLAs and timing – Duration of time since a major incident has occurred, as well as the state of the response and the resolution SLAs for the major incident. You can select View all SLA to see all the task SLAs associated with the incident.
      • Assign to – The assignment status of the incident. You can select the Assign to option to assign the incident to yourself. You can select the View additional collaborators option to view the list of collaborators associated with the incident.
      For more information on the record information in the Contextual side panel, see Viewing incident record information using the Contextual side panel.
    • Collaborate – Select the Collaborate (Collaborate icon) icon to open the Collaborate side panel tab. This tab displays the following tabs:
      • Call – Call-related information for the upcoming, pending, overdue, or active calls with the collaborators such as status and due date with time duration. You can select Start to initiate that call. You can also select the Initiate collaboration (Add call) icon to create a call using various communication channels such as Zoom and Webex.
      • Chat - Chat-related information, such as name, number of participants, and due date, for upcoming, pending, overdue, or active chats with collaborators. You can select Open discussion to start that chat. You can select the Initiate collaboration (Add call) icon to create a chat using various communication channels, such as Microsoft Teams and Slack.
    • On call – Select the Experts on-call (On call icon) icon to identify and contact available on-call members of a support group to resolve an issue.