triaging-incidents

Triaging ServiceNow Incidents

Create, triage, investigate, and analyze incidents. See references/incident-fields.md for the priority matrix, states, categories, and encoded query patterns.

Tables and roles

Tables	Readable with
incident, problem, change_request, sys_user_group	itil (+ snc_read_only for a read-only identity)
cmdb_ci (affected CIs), cmdb_rel_ci (their dependencies)	itil; snc_read_only alone gets 403 on cmdb_ci

Some incident fields stay hidden even from itil. For example, the change links rfc and caused_by can be ACL-protected. list_records then warns that they are missing from every row, and conditions on them are ignored.

When access is denied

• 403 on a table: not assessable with this identity. Say which table, and report what you could read.
• 0 rows or missing fields: possibly hidden by an ACL. Don't report "no incidents" from a read that may be filtered.
• aggregate_records refused (401 under API-key auth, or 403): use the list_records fallback in workflow 5.

Workflows

1. List Recent Incidents

Get a summary of recent incidents by priority, state, or assignment group.

Progress checklist (copy into your response):

- [ ] Query incidents with filters
- [ ] Summarize by priority and state
- [ ] Highlight critical/P1 incidents

1. List recent incidents (last 24 hours, open):

   list_records(table_name="incident", query="active=true^sys_created_on>=javascript:gs.daysAgoStart(1)", fields="number,short_description,priority,state,assignment_group,assigned_to,sys_created_on", limit=20, order_by="-priority")
   

2. For a specific assignment group:

   list_records(table_name="incident", query="active=true^assignment_groupLIKE<group_name>", fields="number,short_description,priority,state,assigned_to", limit=20)
   

3. Summarize: total count, breakdown by priority (P1/P2/P3/P4), breakdown by state, highlight any P1/P2 incidents.