Advanced Incident Management

I had a great time presenting on Advanced Incident Management last week at Knowledge11. During that session I demonstrated a lot of very useful functionality that I’ve used and created to improve the standard incident management setup for technicians working in ServiceNow. Since most of my presentation was a demo, I promised the attendees that I would post information about the solutions we talked about there. Read on if you want to see some great ideas to improve incident management in your organization!

Incident Form

I know some of this is a pretty rough draft. If you’re interested in more detail on any of these topics, please comment below and I’ll write a post to address it.
If you’re interested in seeing the slides from this presentation (or any other session at Knowledge11) you can access them through the ServiceNow community site. Here’s a link!

Overall Goals:

  • Keep it simple!
  • Leverage existing data
  • Smart & intuitive design
  • Get out of the code
  • Automate and simplify repeated tasks

…all with the purpose of speeding time to resolution and improving customer satisfaction!

-Keep it simple!

-Advanced != Complex. Don’t overload your incident form with low-use garbage!
-Base incident form (screenshot above). All information is relevant and useful

-Leverage existing data

Consolidate your ‘Configuration item’ field and ‘Affected CIs’ lists to get a better picture of what’s actually being impacted in your environment.
-Configuration item field macro icons
-BSM Map: relationships, map action icon showing only CI field tasks
Use of ‘Affected CIs’ list with BSM map action icons
-Change calendar (FSC): Don’t forget that change information can be a valuable input into incident resolution.
On-call schedule popup
Custom knowledge search

-Get out of the code

-Lookup tables are a great way to separate code from data and keep yourself out of the code where possible
Priority lookup
Assignment lookup

-Smart & intuitive design

Priority 1 incident scroller
Outlook-style module counts
-Color change on comments field (Field styles)
Simultaneous task update alert
Create user without leaving the form
Knowledge search from homepage

-Automate & simplify repeated tasks & actions

-Templates (Advanced Templates)
Suggestion fields
QuickForm from list

Date Posted:

May 26, 2011

Share This:


  1. Rick May 26, 2011 at 10:58 am


    Did you show a step in the Advanced Incident Management session where you were automatically adding the configuration item from the incident form to the Affected CI related list? I may have missed it in the article, but is this something you can share? Thanks.


    • Mark Stanger May 27, 2011 at 12:54 am

      Rick, I’m glad you asked. There’s enough to this one that it deserved its own post. I’ve linked to it in the article above but here’s a direct link to the solution I posted today for you.

  2. Christian May 26, 2011 at 10:37 pm

    Hi Mark,

    the link behind “Simultaneous task update alert” return a 404 error.

    Also – would you have your presentation (or a link) available somewhere – couldn’t not sit in your session @Knowledge11.



    • Mark Stanger May 26, 2011 at 11:49 pm

      Thank you. I’ve fixed the ‘Simultaneous’ link and added one above that links to the download location for all session slides from Knowledge11. Here’s a direct link to the Advanced Incident Management session slides. As I mentioned above, I really focused on demonstrating the ideas in the tool so I’m not sure how valuable the slide deck will be :).

  3. Will July 25, 2011 at 7:53 am


    I wasn’t sure where to post this, but I’m having some problems with incident management after activating the Best Practice Incident Resolution Workflow plugin. I have tried, with both a client script & a business rule to set resolved to inactive (in the same way that = false for closed incidents) after activating the plugin. It’s not sticking. Do you know of an article on this? It should be a simple fix, but it’s turning out to be much more of a hassle than I originally thought. The sncwiki on the plugin does not address this, but from the description it seems that a resolved incident should be automatically set to inactive because the entire purpose is to reopen (make active) at the request of the caller before a predefined amount of time expires.

    Thanks in advance!


    • Mark Stanger July 25, 2011 at 4:37 pm

      I always set things up so that resolved incidents are actually active incidents. That’s the simplest way. Then if you want to filter out the resolved incidents in a list of ‘Open’ problems or something you just change the filter on your module or report.

Comments are closed.




Fresh Content
Direct to Your Inbox

Just add your email and hit subscribe to stay informed.