I want to know how incident has been created

[JayaPrathyV]

Hi my question is we getting incidents with the name of caller is automated termination and opened by is automated termination I want to know how this incident is created please help me with this 

[Dnyaneshwaree]

Hello @JayaPrathyV ,

Check the existing script, flow, workflows, scripts, scheduled job, inbound action, history and logs to find it.

[Mark Manders]

Check on integrations, flows, scheduled jobs that use this user.

[Selva Arun]

• Check Business Rules:

  • Go to System Definition > Business Rules.
  • Look for any rules that might be setting these fields to "automated termination." Review what conditions and actions are involved.

• Review Scheduled Jobs:

  • Navigate to System Scheduler > Scheduled Jobs.
  • See if any jobs are running on a schedule that could be creating incidents with these fields.

• Inspect Inbound Actions:

  • Go to System Mail > Inbound Actions.
  • Look for any actions related to incoming emails that might be creating incidents with the name "automated termination."

• Check Event and Script Actions:

  • Look at System Policy > Events to see if there are any events that might trigger incident creation.
  • Review any Script Includes or Business Rules for scripts that might be involved.

• Examine Incident Creation Processes:

  • Review any external systems or integrations that might be creating incidents in ServiceNow. Check their settings to see if they use "automated termination" for these fields.

• Review Audit Logs:

  • Check System Logs > Audit to see recent changes to incident records. This might give you clues about how and when incidents are being created.

• Look at Custom Applications:

  • If your ServiceNow instance has any custom applications, review their settings and scripts. They might have custom logic for creating incidents.

    If you believe the solution provided has adequately addressed your query, could you please **mark it as 'Helpful'** and **'Accept it as a Solution'**? This will help other community members who might have the same question find the answer more easily.

    
    Thank you for your consideration.

    
    Selva Arun

[ragersybil]

The incident with the caller and opened by name as Automated Termination is most likely created by an automated system or script that runs in your environment. This usually happens when a specific event or condition is met, such as an employee leaving the company or a scheduled process running in your system. The automation is set up to create these incidents without human input, using a predefined workflow or integration with tools like HR systems, monitoring tools, or job schedulers. To confirm this, check your system's business rules, workflows, or integration logs to see what triggers these incidents.