Incident Management in Service Operations Workspace

  • Release version: Yokohama
  • Updated January 30, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Incident Management in Service Operations Workspace

    Incident Management in Service Operations Workspace (SOW) enables ServiceNow customers to efficiently create, manage, investigate, communicate about, and resolve incidents within a unified interface. It supports comprehensive handling of incidents including major incidents, with specialized tabs and features designed to streamline incident lifecycle management and improve resolution times.

    Show full answer Show less

    Key Features

    • Overview Tab: Displays key incident details such as summary, impact, cause, and resolution. Users can add comments and work notes, and customize the displayed fields to suit their workflow.
    • Investigation Tab: Allows analysis of affected Configuration Items (CIs) classified as cicomputer or ciserver by showing metrics data. This tab supports remediation actions and requires installation of Agent Client Collector (ACC) or Microsoft Endpoint Configuration Manager (MECM) adapters. It supports macOS, Windows, and Linux operating systems and provides customizable metrics views.
    • Communicate Tab: Facilitates communication with stakeholders throughout the incident lifecycle. Available when Major Incident Management or Communication Management plugins are active and configured, it supports managing communications for both incidents and major incidents.
    • Post Incident Report Tab: Enables generation, configuration, publication, and export of post incident reports for major incidents in the resolved state. This helps review causes, resolutions, and identify process improvements to prevent recurrence.
    • Details Tab: Shows detailed incident information such as assignment and related records, with configurable fields to tailor the form layout.
    • Related Records Tab: Lists associated records like task SLAs and affected CIs, providing comprehensive context for incident management.
    • Contextual Side Panel: Offers quick access to record information, collaboration tools like Microsoft Teams, and expert on-call contacts to expedite incident resolution.

    Practical Usage

    • Create incidents and track investigations, solutions, and resolutions directly within SOW.
    • Update incident details on the Overview tab to maintain accurate and actionable incident information.
    • Use the Investigation tab’s remedial actions and metrics to analyze and resolve CI-related issues effectively.
    • Manage communication workflows with stakeholders using the Communicate tab, enhancing transparency and coordination.
    • Generate post incident reports to conduct reviews and implement preventive measures for major incidents.
    • Close incidents once resolved to complete the lifecycle and reopen if necessary for further investigation.
    • Leverage integration with problem, change, and service request management by creating related records directly from the incident.

    Requirements and Configuration

    • Investigation tab visibility and functionality require ACC or MECM adapters installed and configured on associated CIs.
    • Communicate and Post Incident Report tabs depend on activation and configuration of Major Incident Management and Communication Management plugins.
    • Customization options exist for Overview and Investigation tabs to tailor the workspace to organizational needs.

    Outcome

    Service Operations Workspace equips ServiceNow customers with a streamlined and integrated environment for incident management that enhances visibility, communication, and remediation capabilities. By leveraging its tabs and features, users can accelerate incident resolution, improve stakeholder collaboration, and implement continuous improvements through post incident analysis.

    You can create and manage your incidents in Service Operations Workspace.

    Figure 1. Tabs of an incident record page in Service Operations Workspace
    Tabs of an incident record

    Overview tab

    This tab displays the following information about an incident:
    • Summary
    • Impact
    • Cause
    • Resolution

    From the Compose section, you can add comments and work notes for the incident.

    The Overview tab displays the field information along with the field labels, including when you're in read mode.

    For more information on the fields displayed on the Overview tab, see View and update incident information on the Overview tab.

    You can customize the display of the information on the Overview tab. For more information, see Customize the Overview tab for an incident.

    Investigation tab

    This tab enables you to investigate any affected CIs with the ci_computer or ci_server class associated with the incidents. The tab displays the metrics information of the associated primary CI or any affected CI that is selected, which helps you to analyze and resolve the issue. You can use the various remedial actions on this tab to resolve the CI-related issues.

    By default, the tab displays metrics information of the primary affected CI associated with the incident. But you can also select and view the information for any affected CI with the ci_computer or ci_server class that is associated with the incident. For information about how you can set up Investigation Framework, see Setting up Investigation Framework in Service Operations Workspace.

    Note:
    • The tab is visible only if the Agent Client Collector (ACC) or Microsoft Endpoint Configuration Manager (MECM) adapters are installed and configured.
    • The tab displays the metrics information for the CI only in the following conditions:
      • Agent Client Collector or Microsoft Endpoint Configuration Manager (MECM) is installed for the associated CI. This helps to retrieve the metrics data for the CI.
      • The associated CI class is a CMDB CI computer.
    • This feature supports only the macOS, Windows, and Linux operating systems.

    You can also customize the display of the metrics information on this tab. For more information, see Customize the Investigate tab.

    For more information on the metrics displayed on this tab, see Features of the Investigation tab.

    Communicate tab

    This tab displays all the communication tasks and options that enable you to communicate with the stakeholders in the various phases of an incident. This tab is available only if any of the following conditions are met:For more information on the features of the Communicate tab, see Communicating with stakeholders about incidents and major incidents.

    Post incident report tab

    This tab enables you to generate, configure, publish, and export a post incident report for a major incident after it's resolved. The post incident report enables you to review the cause and resolution of the major incident and also identify potential process gaps. Based on this information, you can take preventive measures to avoid the issue in the future or to handle the major incident in a better way. This tab is available only if the following conditions are met:For more information on the features of the Post incident report tab, see Review and update a post incident report.

    Details tab

    This tab displays detailed information about the incident. For example, the short description, assignment details, and related records. For more information on how you can configure fields in this tab, see Configure a task record form in Service Operations Workspace.

    Related records tab

    This tab provides a list view of the records associated with the incident. For example, task SLAs and affected CIs.

    Contextual side panel

    From this section, you can view record information and recommendations, collaborate using Microsoft Teams, and reach out to experts on-call to resolve incidents quickly.

    For more information about Incident Management, see Incident Management.