triaging-incidents

Triaging ServiceNow Incidents

Create, triage, investigate, and analyze incidents. See references/incident-fields.md for the priority matrix, states, categories, and encoded query patterns.

Workflows

1. List Recent Incidents

Get a summary of recent incidents by priority, state, or assignment group.

Progress checklist (copy into your response):

- [ ] Query incidents with filters
- [ ] Summarize by priority and state
- [ ] Highlight critical/P1 incidents

1. List recent incidents (last 24 hours, open):

   list_records(table_name="incident", query="active=true^sys_created_on>=javascript:gs.daysAgoStart(1)", fields="number,short_description,priority,state,assignment_group,assigned_to,sys_created_on", limit=20, order_by="-priority")
   

2. For a specific assignment group:

   list_records(table_name="incident", query="active=true^assignment_groupLIKE<group_name>", fields="number,short_description,priority,state,assigned_to", limit=20)
   

3. Summarize: total count, breakdown by priority (P1/P2/P3/P4), breakdown by state, highlight any P1/P2 incidents.

2. Triage a New Incident

Assess impact and urgency, then suggest priority, category, and assignment group.

Progress checklist:

- [ ] Get incident details
- [ ] Assess impact and urgency
- [ ] Check affected CI and its dependencies
- [ ] Suggest priority, category, assignment group
- [ ] Recommend next steps

1. Get the incident details:

   get_record(table_name="incident", sys_id="<incident_sys_id>")
   

2. If a CI is attached, check its relationships to assess blast radius:

   get_ci(sys_id="<cmdb_ci_sys_id>")
   get_ci_relationships(sys_id="<cmdb_ci_sys_id>")
   

3. Look for similar recent incidents (same CI or category):

   list_records(table_name="incident", query="cmdb_ci=<ci_sys_id>^sys_created_on>=javascript:gs.daysAgoStart(30)", fields="number,short_description,state,priority", limit=10)
   

4. Recommend triage decisions:
   • Priority: Based on impact x urgency matrix (see references/incident-fields.md)
   • Category: Based on the affected CI class and description keywords
   • Assignment group: Based on CI ownership or category routing rules
5. Present recommendations with reasoning.