Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Service Management

Use > Run > Incident Management > Incident Management procedures > Edit an incident record

How to edit an incident record

You can edit an incident record to add information that will help the assigned person or group resolve the incident.

You can edit multiple records simultaneously by selecting them in the grid and updating them in the Preview pane on the right. For more information, see Mass update.

From the main menu, select Run > Incident > Incidents. Service Management displays a list of all incidents.
Select the incident record that you want to edit.

To filter the record list, click the Add filter button. For more information, see Filters.
Click the record identifier in the ID column to display the selected record.
- In the right pane, the Related Contracts widget displays all of the contracts related to the record you are viewing.
  - Click the down arrow to expand the list of related contracts.
  - Click a contract to see its full details.
  The icon in the left of the contract indicates the type of contract:
- In the right pane, the News widget displays current news alerts. Critical news alerts are always listed first, followed by important and normal news articles, listed from newest to oldest. Click the news article to view the full details.
  
  Tip News articles are also displayed in the News by importance widget on the Dashboard.
By default, the incident record opens displaying the General tab selected. Click the tab you want to edit or view:
- General
  
  Displays general information about the current record. For more information about the General tab, see How to edit an incident record.
- Workflow
  
  Displays the workflow metaphase and phase for the current record. For more information about workflow, see Incident workflow.
- Task plan
  
  The Task plan tab is where you design, create, and edit tasks. The tabs that appear under task plan are Investigate, Resolve, and Review, with each matching a workflow phase which may require completion of a task. The parenthesized number on the tab is the number of tasks in each phase.
  
  For more information about tasks and planning, see How to build a task/approval plan.
- Targets
  
  Displays Service Level Target details. For more information about Service Level Targets, see How to edit an incident record.
- Involved CIs
  
  Displays associations with devices and system elements that are related to the current record. For more information about Involved CIs, see How to edit an incident record.
- Related records
  
  Displays records which depend on the current record, or records which the current record depends on. For more information about related records, see How to edit an incident record.
- Related knowledge
  
  Displays knowledge and news articles related to the current record. For more information, see How to edit an incident record.
- Discussions
  
  Displays any relevant conversations about the current record. For more information about discussions, see Discussions.
- History
  
  Displays all changes and updates made to the record. To view changes or updates made to the record, click the History tab. For more information, see History.
Note
- Click the record title to edit it.
- To use a template, click Apply template on the toolbar.
Click Save on the toolbar.

Incident record tabs

General tab

This tab includes the following sections:

Section	Description
Incident details	Contains basic information about the incident record. For more information about incident details, see Incident details.
Classification	Helps you put the incident into the correct workflow with assigned ownership. For more information about classification, see Classification.
Assignment	Provides information about incident ownership. For more information about ownership, see Assignment.
External Assignment	This section is only relevant when an external group is selected in the Assignment group field. The data in the section is populated by the external system.
Major incident team	Lists the stakeholders when the incident requires immediate response by a large group. This team might include managers or technical experts from different business groups. How to add members to the Major incident team: Click Add or the grid icon . Select one or more candidates to be members of the Major incident team. The added items appear in yellow. Click Save. How to delete members from the Major incident team: Select the team members. Click Remove. The selected items appear in strikethrough text. Click Save.
Resolution	Describes the final disposition of the incident. For more information about resolution, see Resolution.
Attachments	Click Add attachment if you want to attach a file to the record. Note The following file formats are supported: jpg; jpeg; gif; png; doc; docx; ppt; pptx; xls; xlsx; pdf; txt; xml; zip; msg; sql; gz; rar; tar; 7z. The maximum file size of an attachment is 10 MB. If the Attachments field has been defined as encrypted for this record type and you are a member of an encryption domain, click Add encrypted attachments to attach an encrypted file to the record. Attachments are not visible in the Service Portal.

Incident details

Field	Description
Title	The title is a summary of the issue presented by the end user. If you omit a title, Service Management uses the beginning text from the Description field. Best Practice: Choose a meaningful, descriptive, and relatively short title. Titles are often the only identification used in selection lists and in other areas to identify components. Service Management displays the title at the top of the form when you edit or display the complete record.
Description	The description captures the details of the incident. You can also capture information that might not fit well elsewhere. For example, if the location and telephone number are different from the contact details, you can record the correct information in this field. Service Management may automatically recognize CIs whose details are entered here. See CI Detection - Automatic recognition of CIs.
Status	Service Management updates this field with a status value when you open, update, close, or escalate an incident. Valid status values are: Ready, In progress, Pending, Suspended, and Complete.
Expected resolution time	Expected resolution date and time. Click the calendar icon to specify the date. Click the clock icon to specify the time.
Contact	The person who should be contacted for follow up questions about the incident. Select a person from the drop-down list.
Preferred contact method	The preferred method for communication with the contact. Select one of the following options: Email Phone
Reported by	The name of the end user who reported the incident.
Next target time	The calculated time before the next Service Level Target will expire. If the target expires, the status of the target is breached.

Classification

Field

Description

Priority

Priority is a read-only value that Service Management chooses based on Impact and Urgency values. The following table describes the priority matrix.

	Enterprise	Site or department	Multiple users	Single user
Total loss of service	Critical	High	High	Medium
Severe disruption	High	High	Medium	Medium
Slight disruption	High	Medium	Medium	Low
No disruption	Medium	Medium	Low	Low

This matrix can be adjusted through business rule configuration.

Service

Services are usually related to one of the following:

Infrastructure. For example, database or network services.
Business services. For example, email or a web portal.

Note At the top of the list of services Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.

Impact

Impact describes the global effect on the user community. Consider whether the incident affects the entire enterprise, a business unit, or an individual. Valid values are:

Enterprise
Site or department
Multiple users
Single user

The default selection is Single user.

Example: Choose Enterprise if the problem affects the entire organization or a critical business unit. Single user is the lowest impact.

Service component

The service component related to the incident.

Category

The category describes the type of incident. The default categories are based on best practice recommendations for service-related processes. They reflect how the incident is assigned and help to organize reporting metrics.

At the top of the list of categories Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.

Urgency

The urgency indicates how important the issue is for the service recipient. If there is an outage or a mission-critical outage, the urgency might be Critical. Valid values are:

Total loss of service
Severe disruption
Slight disruption
No disruption

Example: Choose Total loss of service if there is an outage that directly affects the basic infrastructure, such as network services. Choose Slight disruption if the problem does not need immediate resolution. The end user can provide guidance for these settings because it is how they perceive the impact and urgency within their organization.

Incident model

An incident model is a repeatable way to resolve a particular type of incident. When you choose a model, the incident follows the predefined workflow phases that apply to the model.

At the top of the list of models Service Management displays smart suggestions, based on the text entered in the Title and the Description fields.

Impact start

The time when the impact to the service began (could be a partial or complete impact). Select a date and time.

Impact end

The time when the impact to the service ended (could be a partial or complete impact). Select a date and time.

Assignment

Field	Description
Current assignment	An assignment group is a pool of resources with advanced skills to resolve the incident when the incident owner or the customer escalates the incident. The assignee becomes responsible for the incident resolution. Select a value from the drop-down list. The following values are available: Unassigned. No group or person is assigned to the incident. Service desk. The group selected in the Service desk group field is assigned to the incident. The person selected in the Service desk owner field becomes the incident assignee. Expert group. The group selected in the Expert group field is assigned to the incident. The person selected in the Expert assignee field becomes the incident assignee.
Service desk group	A Service desk group is a pool of resources. The Incident Manager can choose a group to own the incident. One or more members of the group can work on the incident resolution. Select a group from the drop-down list. Only functional groups are available. This field is mandatory when Service desk is selected as the current assignment.
Owner	The incident owner is responsible for the incident until it is resolved. Select a person from the drop-down list or type a few characters to search for the required person.
Expert group	Select a group from the drop-down list. Only functional groups are available. This field is mandatory when Expert group is selected as the current assignment.
Expert assignee	Select a person from the drop-down list or type a few characters to search for the required person.
External reference number	This entry applies only when there is a third party involved and they have a separate tracking number. Example: The outage resolution depends on a vendor repair of related equipment that is under warranty. In this case, you should type the vendor incident number.

Resolution

Service Management uses the text that you provide in the Title and Description fields to launch a knowledge search as soon as you expand the Resolution section. Service Management searches for existing articles or other records that contain matching information. For example, if your description includes the words "email server down", Service Management searches for those words throughout the knowledge database. If a match occurs, the Suggested solutions link is displayed. Click the link to see the top three solution candidates. These matches can be any of the following record types:

Articles
User questions
External knowledge
Problems
Changes
Incidents

If you want to link one of the suggested solutions to this record, hover your mouse over the end of the solution entry to display action buttons. The buttons and actions vary depending on the type of potential solution record.

Click one of the buttons described in the following table.

Link to record type	Action	Result
Change Incident Problem Request	Link	Updates the list of related records on the Related records tab in both the current incident and the linked change, incident, problem, or request record.
Incident Problem	Copy + link	Copies the solution text from the referenced incident or problem into the Solution field of the current incident. Updates the list of related records on the Related records tab in both the current incident and the linked incident or problem record. Note If there is no prospective solution found, Service Management does not display this button.
Article	Copy link	Copies a link to an article into the Solution field of the current incident. Note Only articles that are in the External phase of the workflow are eligible to be solution links.
Q and A	Copy link	Copies a link to a question and answer into the Solution field.

If you want to search for other suggested solutions for the current incident, click Find more solutions at the bottom of the Resolution section.

Service Management inserts a search form at the top of the page where you can type a search argument to produce a complete list of potential solution matches. You can use "or," "and," or a wild card character to enhance your search argument.

All returned results appear in the left pane. If you select a record, the record details appear in the right pane. If you find a suitable match, do one of the following:

Click Copy solution to copy information from an incident or problem into the Solution field of the current incident.
Click Copy link to resolution to copy a link to an article or question and answer into the Solution field of the current incident.
Click Link as cause to add information about a change to the Related records tab in the Causes of the incident section of the current incident.
Click Link as effect to add information about a change to the Related records tab in the Effects of the incident section of the current incident.
Click Link as related to add information about a request to the Related records tab in the Causes of the incident section of the current incident.

Complete the Resolution section with as much information as possible.

Field	Description
Problem candidate	A checked box specifies that the incident has a root cause, and that it can be resolved through Problem Management processes.
Knowledge candidate	A checked box specifies that the solution details can apply to future incidents.
Solution	A detailed description of the resolution. If the solution is a knowledge or problem candidate, the solution description should be as specific as possible. If you linked an article, the link appears in this field. Service Management may automatically recognize CIs whose details are entered here. See CI Detection - Automatic recognition of CIs.
Completion code	The completion code describes the reason that you can close the incident. Example: In the case of immediate resolution, the completion code might be Resolved with workaround.
Closure category	The categorization of the incident as determined after the incident has been resolved. Select a value from the drop-down list.
Solved time	The time when the incident resolution was applied. There may be a delay between the actual resolution and its application. Select a date and time.
Suggested solutions	Click Suggested solutions to have Service Management suggest solutions, based on the information provided for the incident. If none of these are relevant, you can click Find more solutions to look for other solutions in the database.

Targets tab

This tab includes the fields described in the following table.

Field	Description
Next target time	Displays the earliest breach time for a Service Level Target or Operational Level Target for this incident. The target can be an initial review or a resolution target or a Time in group Operational Level target. For more information, see Service Level Target status and history.
Overall status	Displays the status of the Service Level Target or Operational Level Target with the highest severity. The order of severity from highest to lowest is: Failed Breached Suspended Active Achieved
Show SLT history	Click the Show SLT history button to open the SLT history dialog box, which displays all SLT operations recorded for all of the targets. For more information on the SLT history, see Service Level Target history. Note The table in the SLT history dialog box may aggregate operations that occurred within one minute into a single operation. Only the last operation of the aggregated operations appears in the list.
Service Level Targets	This shows all associated targets and their current status. You can edit the details of each target to refine its objectives. Service Management associates the initial review and resolution targets with incidents according to the agreements defined on the actual service related to the incident. If no specific agreement was defined for the service, the default agreement is used. Alternatively, you can define business rules to specify the active agreement. For more information, see Relating Service Level Agreements to records. Next SLA target time. Displays the earliest breach time for the Service Level Target for this incident. Overall status. Displays the status of the Service Level Target with the highest severity. Service level agreement. Displays a link to the active agreement (if one exists).
Operational Level Targets	This section shows all associated Operational Level Targets and their current status. You can edit the details of each target to refine its objectives. Service Management associates Time in group targets with incidents according to the agreements defined on the actual service and the assignment group of the incident. If no specific agreement was defined for the service, the default agreement is used. Alternatively, you can define business rules to specify the active agreement. For more information, see Relating Service Level Agreements to records. Next OLA target time. Displays the earliest breach time for the Operational Level Target for this incident. Overall status. Displays the status of the Operational Level Target with the highest severity. Service level agreement. Displays a link to the active agreement (if one exists).

Involved CIs tab

In this tab you may add, change, or delete associations with business devices, infrastructure and peripheral assets, licenses, and system elements that are related to the record. When you link a device, an infrastructure asset, a license, or a system element to a record, you create an internal relationship between them.

In this tab you can also view a topology impact map for each device and system element you choose, and the affecting CIs and a topology impact map for each affected service.

The Involved devices section enables you to link a device.
The Involved infrastructure & peripherals section enables you to link an infrastructure or peripherals.
The Involved licenses section enables you to link a fixed asset license.
The Involved system elements enables you to link a system element.

How to add an involved device, an infrastructure & peripheral asset, a license, or a system element

Click Add or the grid icon .
Select the required records. The added items appear in yellow.
Click Save.

How to delete an involved device, an infrastructure & peripheral asset, a license, or a system element

Select the required records.
Click Remove. The selected items appear in strikethrough text.
Click Save.

How to view an impact map for a device

In the Involved Devices section, select the device.
Click Show Impact. An impact map of the device is displayed.

How to view an impact map for a system element

In the Involved System elements section, select the system element.
Click Show Impact . An impact map of the system element is displayed.

You can zoom in and out of the impact map by using the mouse wheel button. If a text string is too long to be displayed, an ellipsis (…) appears. You can hover over the ellipsis to display the full text string.

You can hover over the following icons in the impact map:

Owner avatar – a window is displayed with the owner’s details.
Business criticality – a tooltip is displayed with the criticality.
Location – a tooltip is displayed with the name of the location.

Depending on the size of the impact map and the browser window, Service Management may not display the subtype of a Device, Service or System Element. Hover over the subtype graphic to see a tooltip with this information.

Related records tab

The Related records tab enables you to review, create, and delete relationships among Service Management records. The number at the end of the tab label displays the number of related records for the current record. There are two types of related records:

Other record types depend on the current record.

Example: an employee requests a certain change to an email account. The request triggered an incident because there is an email server outage. You cannot complete the change until the incident status is closed.

The current record depends on other record types.

Example: the incident to repair the email server outage generates a problem record because this is a recurring outage that requires investigation. The problem resolution requires finding the root cause for the outage. When the outage is resolved, the incident is resolved. When the incident is resolved, the change request can be resolved.

Resolving a request for change, an incident, or a problem can also involve hardware or software acquisition, or even require a new service to be available. Service Management also enables you to link asset records to changes, incidents, or problems.

To relate records

Click the Related records tab to display a list of related records that
- depend on the current record
- the current record depends on

In each section, the default sort order is first by record type, then by phase. You can click a column heading to reverse the sort order in any column.

Field	Description
ID	The identifier of the record. Click the ID value to link to the record.
Title or Name	A short description provided by the end user.
Phase	The current phase of the current record in the workflow.
Priority	The priority is a value based on urgency and business impact values.

In the appropriate section, do one of the following:
- Click Add to create a relationship between the current record and another record.
  
  The Add related record dialog box opens, displaying a list of potential related records. If you select an individual record, Service Management displays the contents of that record in the right pane.
  - To search for more records, use the Search box at the top of the dialog box.
  - Find the record that you want to link, and click OK to create the relationship.
- Click Remove to delete the relationship between the current record and the selected record. Click OK to confirm the action.
  
  Note This action removes the relationship between the two records only. It does not delete either record.

Related knowledge tab

The Related knowledge tab is where related knowledge or news articles are displayed.

Action	Procedure
Add a knowledge or news article	Click Add. The Add related record dialog box opens. Select a knowledge or news article. You can filter the selection using the drop-down list and the filter button. Click Add in the right pane of the dialog box. Repeat the above 2 steps as required, and then click OK. The selected records are added to the Related knowledge tab.
Remove a knowledge or news article	Select the knowledge article or news article you want to delete. Click Remove, and then OK.
View a knowledge or news article	Select the knowledge or news article you want to view. Click the record identifier in the ID column to display the selected record.

Editing the incident form

If you have the appropriate permissions, you can edit the incident form. For more information, see How to edit a form and Generic relationship fields.