INCIDENT MANAGEMENT IN SERVICENOW
1. What is Incident Management in ServiceNow?
Incident Management is about restoring service quickly when something breaks.
• Real-time deep example:
Imagine your company’s email server crashes at 9 AM. Suddenly, 2,000 employees
cannot send or receive emails.
• ServiceNow automatically logs multiple incidents as users report issues.
• The Incident table tracks each case.
• Assignment rules route them to the Messaging Support Team.
• SLA timers start ticking (e.g., “Resolve within 2 hours”).
• Notifications go out to managers about the outage.
• The support team restarts the email server and service is restored.
Here, ServiceNow ensures visibility, accountability, and speed.
2. What is the main objective of the Incident Management process?
The goal is restoration, not root cause analysis.
• Real-time deep example:
Remote employees lose VPN access during a critical client meeting.
• IT team applies a temporary reroute, so VPN works again.
• Business impact is minimized.
• Later, a Problem record investigates why VPN failed (e.g., firewall
misconfiguration).
This shows how Incident Management focuses on business continuity first.
3. Define an incident with an example.
An incident = unplanned interruption.
• Real-time deep example:
Yesterday, a user accessed SAP fine. Today, they get “Access Denied.”
• This is an incident because it’s an unexpected failure.
• ServiceNow logs it, assigns it to the SAP support team, and tracks resolution.
But if the same user requests new SAP access, that’s a Service Request, not an incident.
4. What information is captured while creating an incident?
Key fields ensure clarity and prioritization.
• Real-time deep example:
Caller: John Smith
Short Description: “VPN disconnects every 2 minutes”
Impact: High (sales team blocked)
Urgency: High (critical client demo ongoing)
Priority auto calculated: P1
Assignment Group: Network Support
This structured data ensures the right team works on the right issue quickly.
5. Difference between Incident and Service Request Incident.
Real-time deep example:
“My laptop won’t turn on” → Incident (unexpected failure).
“I need a new laptop” → Service Request (planned need).
ServiceNow distinguishes them so support teams don’t waste time mixing requests with
outages.
INTERMEDIATE LEVEL
1. Explain the Incident Management lifecycle in ServiceNow.
Real-time deep example:
Outlook crashes for a user:
1. New – User reports issue.
2. In Progress – Assigned to Desktop Support.
3. On Hold – Waiting for Microsoft patch.
4. Resolved – Patch installed.
5. Closed – User confirms fix.
This lifecycle ensures traceability and SLA compliance.
2. What are the priority levels in Incident Management and how are they calculated?
Priority = Impact + Urgency.
• Real-time deep example:
Payroll system fails on salary day.
Impact: High (entire company affected).
Urgency: High (must be fixed today).
Priority auto-set: P1 Critical.
This ensures critical issues jump to the front of the queue.
3. What is incident assignment and how is it handled?
Real-time deep example:
User reports VPN issue.
Category = Network → Auto-assigned to Network Support Team.
No manual routing needed.
This saves time and avoids misrouting.
4. How Impact and Urgency affect priority?
Impact:
• How many users/business units affected
Urgency:
• How quickly it must be fixed
Impact Urgency Priority
High High P1
High Medium P2
Medium Medium P3
Low Low P4
Real-time Example:
• Payroll system down on salary day
o Impact: High
o Urgency: High (if both then Priority: P1)
ADVANCED LEVEL
1. What is the relationship between Incident Management and Problem Management?
Real-time deep example:
Multiple incidents: “Database slow.”
Problem record created → Root cause = Index corruption.
Permanent fix applied.
Incident = quick fix, Problem = long-term solution.
2. Explain Incident Assignment Rules with an example?
Real-time deep example:
Rule: IF Category = Network AND Subcategory = VPN → Assign to VPN Team.
User logs VPN issue → Auto-assigned instantly.
This reduces manual overhead.
3. What are the required fields while resolving the incident?
• Real-time deep example:
Resolution Code: Permanent Fix
Resolution Notes: “Restarted VPN service and applied patch.”
State: Resolved
Mandatory fields ensure clear documentation.
4. Explain priority lookup rules with examples.
Real-time deep example:
Core banking system outage.
Impact = High, Urgency = High → Priority auto-set to P1.
This prevents human error in prioritization.
5. What is the data lookup rule?
• Real-time deep example:
CI = Email Server → Assignment Group auto = Messaging Team.
User selects Email Server → Incident routed instantly.
This speeds up incident handling.
6. What is the difference between work notes and additional comments?
• Real-time deep example:
Work Note (internal): “Restarted IIS services.”
Additional Comment (user-facing): “Your issue has been resolved. Please verify.”
This separates technical details from customer communication.
7. What is the use of the activity tab on the incident form?
Real-time deep example:
Manager reviews incident:
• Sees when it was logged.
• Who worked on it.
• What notes were added.
• When it was resolved.