Incident INC001, who all user have access the ticket

[ShubhiSharm]

There is an INC001 ticket where by mistake password has been given and know user want to know who all have accessed the ticket. How to see logs

Time Frame: 2025-06-05 12:34:01 IST

[Dr Atul G- LNG · Accepted solution]

Hi @ShubhiSharm 

Try this: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0520375

[palanikumar]

Hi,

It depends on how you configured. By default it is visible to the Requestor and all resolver with ITIL, Incident_read and admin access.

If you have added ACL or Query business rule then there might be more restrictions.

[Dr Atul G- LNG · Accepted solution]

Hi @ShubhiSharm 

Try this: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0520375

[Ankur Bawiskar · Accepted solution]

@ShubhiSharm 

the event log table will tell you who accessed the incident

Whenever an incident is viewed an entry is made to this table and you will know the details

But remember the event log table is also cleared after sometime

1) User name - user who viewed

2) instance - record sysId

3) name - user.view

If my response helped please mark it correct and close the thread so that it benefits future readers.