---
sourceDocument: Brazil IT Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-service-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Create an incident

# Create an incident {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read  
Create an incident record to document a deviation from an expected standard of operation.

## Before you begin

Role required: itil, sn_incident_write, or admin

## About this task

Agents with the itil role complete the Incident form to log incidents. Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance.

## Procedure

1. Navigate to AllIncidentCreate New.  
   You can also select New from the Incident list view.  
   Note:  
   If the Incident module is not visible in the All menu, contact your administrator to verify that the itil or sn_incident_write role is assigned to you.
2. **Optional:** Use a template if one exists for the type of incident that you are logging.  
   If the organization uses form templates, then you can apply a template to pre-populate some of the fields for specific types of incidents. For more information, see [Use a template](https://www.servicenow.com/docs/DOIwbJ7GAczrcRmUp~LOIA "Use a template to apply values to an incident record. The template values replace existing field values, and fields that aren't in the template remain unchanged.")
3. On the form, fill in the fields.  
   Your organization has configured the Incident form to adhere to its incident management process. The information that you enter in the form fields depends on that process. The following table describes typical Incident
   form fields.  
   {#create-an-incident__table_wjm_hsv_vy__entry__2}

   | Field | Description |
   |:-|:-|
   | Number | Unique system-generated incident number. |
   | Caller | User who contacted you with an issue. |
   | Category and Subcategory | Type of issue. After selecting the category, select the subcategory, if applicable. |
   | Service | Affected business service, if applicable. Note: If the selected business service is also a configuration item in another active task, the active tasks icon ![]() appears. Select the icon to view all active tasks affecting the business service. You can view the BSM map (dependency view) of the selected business service by selecting the dependency icon ![](). |
   | Service Offering | Service offering consists of one or more service commitments that uniquely define the level of service in terms of availability, scope, pricing, and packaging options. This field enables you to receive different features and their levels of performance for a given service. |
   | Configuration item | Affected CI, if applicable. After a CI is selected, you can select the Dependency views icon ![]() next to the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues. To capture information on the affected CIs, refer to [Capture information on affected configuration items](https://www.servicenow.com/docs/Uv5dBq6HjV_ACgZ6SOHe4Q "Capture information about the asset configuration items (CIs) that are affected by an incident to keep a record of the CIs that are updated, repaired, swapped, or retired."). Search results in the Configuration item field display a list of configuration items (CI). Results are sorted alphabetically by CI name. |
   | Channel | Communication method that is used by the user to create the incident. The available options are: * Chat * Email * Phone * Monitoring * Self-service * Virtual agent * Walk-in {#create-an-incident__ul_stk_tpr_qtb} |
   | Origin | Source of the incident. For example, if an incident is created from alert, this field contains the value Alert. This field is auto-populated and can't be edited manually. |
   | State | State of the incident. The state moves and tracks incidents through several stages of resolution. Tip: Use the State field, rather than the Incident State or Problem State fields, as your primary means of tracking the state of an incident because this state progresses through the entire processing cycle. To learn more, see [Incident life cycle](https://www.servicenow.com/docs/0pZzK22azynVNg~oFWGBLw "Incident Management manages incidents through a defined set of states, from creation to closure, so you can track where each incident is in its life cycle."). |
   | Impact | Measure of the effect of an incident on business processes. |
   | Urgency | Measure of how long the resolution can be delayed until an incident has a significant business impact. |
   | Priority | Value based on impact and urgency that identifies how quickly the service desk should address the task. This value is calculated based on the selected values in the Impact and Urgency field. Note: When you initially create and save an incident, the Work notes field isn't required. If you change the priority of the incident by selecting different Impact or Urgency values on an incident form that was saved, the Work notes field becomes required. |
   | Assignment group | Group that works on the incident. The business rule Populate Assignment Group based on CI/SO populates the Assignment group field based on the support group available for the configuration item (CI) or the Service offering consecutively. Note: The business rule is triggered when an incident is created or updated, and when the Assignment group and the Assigned to fields are empty. To override the default value, create new properties and provide the field in the property value that must be used to populate the Assignment group field. Create the properties in the following order of preference: * com.snc.incident.ci_assignment_group.field_name: Identifies which CI field populates the Assignment group field. * com.snc.incident.service_offering_assignment_group.field_name: Identifies which service offering field populates the Assignment group field. {#create-an-incident__ul_lmp_tp2_s4b} Note: * The sys_user_group read ACL calls the SNCRoleUtil function. The function verifies whether the group that is reviewed contains either the admin role or security_admin role. The function enables the user to view the group only if the user has the same role. As a result, a user with the itil role cannot assign an incident to a group that has the admin role or security_admin role. This restriction also applies to any group whose parent has those roles. * Other than using the read ACLs, you can also restrict incidents with specific assignment groups for visibility only to the group members using before-query business rule. For details, see [How to restrict a specific group incidents to only its group members \[KB0790987\]](https://support.servicenow.com/nav_to.do?uri=/kb?id=kb_article_view&sysparm_article=KB0790987) article in the Now Support Knowledge Base. You must log in to view the article. {#create-an-incident__ul_a1p_yls_vvb} |
   | Assigned to | User who works on this incident. If the Assignment group changes, the Assigned to field is cleared. |
   | Short description | Brief description of the incident. |
   | Description | Detailed explanation on the incident. |
   | Attachments | Attachments related to the incident that help resolve the incident, such as screenshots or PDF files. Select the attachment icon ![]() to add and manage the attachments. |
   | Notes ||
   | Watch list | Users who receive notifications about this incident when comments are added. Select the add me icon ![]() to add yourself to the watch list. |
   | Work notes list | Users who receive notifications about this incident when work notes are added. Select the add me icon ![]() to add yourself to the work notes list. Note: The administrator must create an email notification for the work notes list. |
   | Additional comments (Customer visible) | More information about the issue as needed. All users who can view incidents, including the customer, can see additional comments. |
   | Work notes | Information about how to resolve the incident, or steps taken to resolve it, if applicable. Note: Only the internal users who are involved and responsible for working and resolving the incidents can view the work notes. |
   | Actions taken | Journal field for details of the actions taken for a major incident. This field is visible only to internal users. Note: This field is only visible when you activate the Major Incident Management plugin (com.snc.incident.mim). |
   | Related Records ||
   | Parent Incident | Unique number of the parent incident for this incident record. |
   | Problem | Unique number of any problem record related to the incident. |
   | Change Request | Unique number of any change request related to the incident. |
   | Caused by Change | Unique number of the change request that resulted in the creation of the incident. |
   [Table 1. Incident form]

   {#create-an-incident__table_wjm_hsv_vy}  
   Note:  
   The Caller and Company fields are optional for the following situations:
   * An incident is created from an alert.
   * An incident is created from a change request. In such case, the change request number is populated in the Caused by Change field.
   {#create-an-incident__ul_zyn_3jw_fsb}
4. Select Submit.
{#create-an-incident__steps_vf2_tzt_sbc}

## Result

The incident is created.

## What to do next

Use the incident form to perform multiple actions to work and resolve the incidents. For more information, see [Working with the incident record form](https://www.servicenow.com/docs/j7N3YZnyK8W49Fqo~2mCVw "After an incident is created, you can use the incident record form to track, process, and resolve the incident.").
**Related concepts**   

* [Managing major incidents](https://www.servicenow.com/docs/VxnJ5SVXfcM_CrlEeGGYRA "A major incident (MI) significantly disrupts the business and requires a response beyond the routine incident management process. Major incidents follow a separate procedure with shorter timescales and higher priority to speed up resolution for incidents with high business impact.")  
**Related tasks**   

* [Create a record from an incident](https://www.servicenow.com/docs/yfDKT3F783BvhwWS5G1GVg "Create a problem, change, or request record from an incident.")

*[\>]: and then