Should we create incident or case from an alert in event management?

[Community Alums]

We have a CSM module and recently implementing integrations with monitoring tools by leveraging event management. We would like to understand whether incident should be created from an alert or customer case.

What is the best practice?

[AndersBGS]

Hi @Community Alums ,

From my understanding, the customer service management application is for customer cases, and also as defined by ServiceNow: A case is a means of capturing the details of a service, project, transaction, or response to customer requests.

From my point of view, it would be an incident, when it comes from monitoring tools. I guess that your monitoring tool is setup to capture dysfunctionality or interruptions to already items/services introduced into operation.

So the short answer - it should be an incident.

If my answer has helped with your question, please mark my answer as accepted solution and give a thumb up.

Best regards

Anders  

[Community Alums]

Hi @AndersBGS ,

Thank you for your suggestion but I do have a additional questions.

1. There is install base item in CSM & the affected install base related list on the Alert form displays the install base items that are linked to the impacted services (CIs).

2. There is a functionality of create proactive cases from an alert which actually creates incident & case and link both to alert. Pleasd find Below documentation by ServiceNow -

https://docs.servicenow.com/bundle/tokyo-customer-service-management/page/product/customer-service-m...

Still will it be best to go with incidents? Can you please provide more insight as we need to convince clients with strong points.

[AndersBGS]

Hi @Community Alums ,

Yeah, I see your point. After reading a bit, and as far as I understand it, cases is for external person, where incidents is for internal persons. E.g. if you have a client where you're handling their infrastructure, and the client infrastructure is having an event which is send to your ServiceNow instance, it should be a case (CSM).

But if your infrastructure is causing an event which will impact customers, the event will be send to your ServiceNow instance, then it should be an incident. 

I also found this post which actually gave a lot of sense - please give it a read through: https://www.servicenow.com/community/developer-forum/main-differences-between-itsm-and-customer-service-modules/m-p/1983084

If my answer has helped with your question, please mark my answer as accepted solution and give a thumb up.

Best regards

Anders