What is Incident in ServiceNow?
An incident is an unplanned interruption to an IT service or a reduction in its quality, such as “I can’t log in to email.” Incident management aims to restore normal service as quickly as possible.
The incident lifecycle
Incidents are stored in the incident table. A typical record moves through the states New, In Progress, On Hold, Resolved and Closed. Users can raise incidents through the portal, email, phone, chat with Virtual Agent, or automatically from monitoring alerts through Event Management.
Once logged, an incident is categorized, prioritized and assigned to a group. The agent investigates, applies a fix or workaround, and resolves the record. The caller can confirm or reopen it; otherwise it closes automatically after a set period.
Priority, impact and urgency
Priority is usually calculated, not chosen. Impact describes how many people or how much of the business is affected, and urgency describes how quickly it needs to be fixed. A lookup matrix combines the two into Priority 1 (critical) to Priority 5 (planning). Priority then drives SLAs and notifications.
Incident vs. request vs. problem
An incident means something is broken. A request means someone wants something new, like software access, and belongs in the Service Catalog. A problem is the underlying cause of one or more incidents. Keeping these apart keeps your reporting honest: requests logged as incidents make your service look less stable than it is.
Major incidents
When an outage affects many users or critical services, a major incident process takes over, with a dedicated major incident manager, stakeholder communication, and a post-incident review. ServiceNow supports this with major incident candidates, communication plans and the Major Incident Workbench.
Best practices
Link incidents to the affected CI and service so impact is visible. Use knowledge articles and Predictive Intelligence to speed up resolution. Keep categories simple; long category trees are rarely filled in correctly.
Frequently asked questions
Who can create an incident?
Anyone with access, typically through the Service Portal or Employee Center. Agents with the itil role can create and work incidents in the platform UI or a workspace.
What is the difference between Resolved and Closed?
Resolved means the agent believes the issue is fixed and the caller can still reopen it. Closed is final and is usually set automatically after a waiting period.
When should an incident become a problem?
When the same issue keeps coming back, or a major incident occurs, a problem record should be raised to find and remove the root cause.
Related ServiceNow terms
Need help with Incident or anything else in ServiceNow? We’re here with practical solutions that fit your organization and your teams.
Browse all 100 ServiceNow terms
ServiceNow is a trademark of ServiceNow, Inc. This glossary is an independent resource by Sequal Consultancy and is not affiliated with or endorsed by ServiceNow, Inc.