Managing a major incident record

  • Release version: Yokohama
  • Updated January 30, 2025
  • 5 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Managing a major incident record

    This guide explains how ServiceNow customers can effectively manage major incident records using various tabs and playbooks within the ServiceNow platform. It details the process from proposing a major incident to promoting it and managing all aspects of the incident lifecycle. The major incident manager plays a central role in reviewing, accepting, and promoting incidents to major incidents, using the information available on the incident record page.

    Show full answer Show less

    Tabs and Key Functions

    • Overview tab: Displays essential incident information such as summary, impact, location, affected configuration items (CIs), cause, and resolution. It also provides an activity feed and options to add comments, work notes, and emails.
    • Details tab: Shows detailed incident data, including category, assignment group, watch list, cause, and resolution details.
    • Communicate tab: Manages communication tasks with stakeholders throughout the major incident lifecycle.
    • Related records tab: Lists associated records like task SLAs and affected CIs to provide additional context.
    • Playbook tab: Displays available major incident playbooks, guiding agents through structured workflows for handling major incidents.

    Contextual Side Panel Features

    • Major Incident Playbook: Provides a guided, task-oriented approach to manage the major incident process, including current playbooks and historical data.
    • Recommended Actions: Lists suggested steps and allows creation of problem records when none exist, with configurable field copying from incidents to problems.
    • Record Information: Shows detailed incident metadata such as active calls, caller details, SLAs, assignment status, and collaborators.
    • Collaborate: Facilitates real-time collaboration through calls (Zoom, Webex), chats (Microsoft Teams, Slack), and identification of on-call experts.

    Practical Workflow

    • Propose a Major Incident: Agents can propose an incident as a major incident candidate based on gathered information.
    • Promote a Major Incident: After review, major incident managers can promote the candidate to an active major incident.
    • Communicate and Collaborate: Use the Communicate tab and collaboration tools to maintain stakeholder communication and resolve incidents efficiently.
    • Resolve and Close: After resolving the incident, reinstate services and close the major incident record.
    • Post Incident Review: Review Post Incident Reports to analyze causes and resolutions, aiding in prevention of future incidents.

    Benefits for ServiceNow Customers

    By leveraging these features, ServiceNow customers can streamline the management of major incidents, ensuring a coordinated response, clear communication with stakeholders, and comprehensive documentation throughout the incident lifecycle. The integration of playbooks and collaboration tools supports faster resolution and continuous improvement through post-incident analysis.

    Manage a major incident record with a playbook or the various tabs on the major incident record page.

    Based on the information displayed on different tabs, an agent can propose a major incident using the Propose Major Incident option. A major incident manager reviews the information on the Overview tab, such as the location information, and then accepts or rejects the major incident proposal. After a proposal is accepted, the major incident manager uses the Promote Major Incident option to promote the candidate to a major incident.

    After an incident is promoted to a major incident, each tab on a Major Incident record page contains information about the major incident. You can use the various options and the action menu to manage the major incident process and view incident information on the following:
    • Overview tab
    • Details tab
    • Communicate tab
    • Related tab
    • Playbook tab
    • Contextual side panel
    Overview tab
    The Overview tab displays the incident information in the following sections:
    • Summary – Basic incident information, such as short description, description, impact, urgency, and state.
    • Impact:
      • Impact summary - Impact summary information, such as business impact, configuration item, service, and service offering.
      • Location – The location of the caller on the world map, the number of locations, and the number of users. This information is only displayed for a major incident and if you have the major_incident_manager role.
      • Affected CIs – The number of CIs affected by the incident.
      • Impacted Services/CIs – The number of CIs and services impacted by the incident.
      • Assets – The number of assets associated with the incident.
    • Cause – The probable cause of the incident.
    • Resolution – Incident resolution-related information, such as resolution code and resolution notes, once the incident is resolved.

    On the Activity section, you can view all comments, work notes, actions taken, and composed emails. This section also includes user activities, such as a change in the state and the assignment group. In the Compose section, you can add comments, work notes, and actions taken, as well as compose emails.

    For more information on the Overview tab, see View and update incident information on the Overview tab.

    Details tab
    The Details tab displays detailed information about the incident, such as category, subcategory, impact, related record, assignment group, watch list, cause, and resolution. For more information on the Details tab, see Incident Management in Service Operations Workspace.
    Communicate tab
    The Communicate tab displays the list of communication tasks with various options that are used to maintain communications with the stakeholders for major incidents. For more information on the options available on the Communicate tab, see Communicating with stakeholders about incidents and major incidents.
    Related records tab
    The Related records tab provides a list view of the records associated with the major incident. For example, task SLAs and affected CIs.
    Playbook tab
    The Playbook tab displays the information of the playbooks available for Major Incident Management. For each playbook, you can select to work with the playbook to manage major incidents. For more information, see Managing major incidents using playbooks.
    Contextual side panel options

    On the Contextual side panel, you can use the following options:

    • Major Incident Playbook – Select the Major Incident Playbook (Major incident playbook) icon to launch the playbook side panel. The playbook provides a guided approach to the entire major incident process. It provides a way to visualize business process workflows for major incidents in a simple, task-oriented view. The playbook contains the following two tabs:
      • Current – List of major incident playbooks running currently.
      • History – Historical list of major incident playbooks.
    • Recommended actions – Select the Recommended Actions (Recommended actions for ITSM) icon to launch the View recommendation side panel. The side panel lists all the recommended actions for major incidents. When an incident is promoted to a major incident and doesn’t have a problem record associated with it, this tab displays a card with the Create a problem option to create a problem record.

      You can also configure whether the incident field information is copied automatically when a problem record is created by using the List of attributes (comma-separated) that will be copied from the incident to create a new problem (com.snc.problem.create_from_incident.attributes) system property. For more information, see Create a problem.

    • Record Information – Select the Record information (Record information) icon to view the incident record information on the side panel. The record information side panel includes the following information:
      • Active calls – Details of the active conference calls for major incidents. You can select the call record to start a conference call.
      • Caller details – Name, local time, address, email id, and other caller information. Select the Contact option to view the caller details and caller assets. You can also see recent interactions and incidents with the caller.
      • SLAs and timing – Duration of time since a major incident has occurred, as well as the state of the response and the resolution SLAs for the major incident. You can select View all SLA to see all the task SLAs associated with the incident.
      • Assign to – The assignment status of the incident. You can select the Assign to option to assign the incident to yourself. You can select the View additional collaborators option to view the list of collaborators associated with the incident.
      For more information on the record information in the Contextual side panel, see Viewing incident record information using the Contextual side panel.
    • Collaborate – Select the Collaborate (Collaborate icon) icon to open the Collaborate side panel tab. This tab displays the following tabs:
      • Call – Call-related information for the upcoming, pending, overdue, or active calls with the collaborators such as status and due date with time duration. You can select Start to initiate that call. You can also select the Initiate collaboration (Add call) icon to create a call using various communication channels such as Zoom and Webex.
      • Chat - Chat-related information, such as name, number of participants, and due date, for upcoming, pending, overdue, or active chats with collaborators. You can select Open discussion to start that chat. You can select the Initiate collaboration (Add call) icon to create a chat using various communication channels, such as Microsoft Teams and Slack.
    • On call – Select the Experts on-call (On call icon) icon to identify and contact available on-call members of a support group to resolve an issue.