Incident Management in Service Operations Workspace

  • Release version: Zurich
  • Updated July 31, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Incident Management in Service Operations Workspace

    Incident Management in Service Operations Workspace (SOW) enables you to create, track, and manage incidents efficiently within a unified interface. The workspace offers multiple tabs to view comprehensive incident details, collaborate, and take remedial actions to resolve issues promptly.

    Show full answer Show less

    Key Features

    • Overview tab: Displays essential incident information such as summary, impact, cause, and resolution. It includes a Compose section for adding comments and work notes, and the display can be customized to fit your needs.
    • Investigation tab: Allows investigation of affected Configuration Items (CIs) of classes cicomputer or ciserver. It shows metrics for primary or selected affected CIs to analyze and resolve issues. This tab requires Agent Client Collector (ACC) or Microsoft Endpoint Configuration Manager (MECM) adapters and supports macOS, Windows, and Linux operating systems. The display of metrics is customizable.
    • Communicate tab: Facilitates communication with stakeholders during incident phases. It is available when Major Incident Management is configured or when communication management applications are active. This tab supports managing communications for both major incidents and standard incidents.
    • Post Incident Report tab: Enables generation and management of post-incident reports for major incidents after they are resolved. These reports help review causes, resolutions, and identify process improvements to prevent recurrence. Available only when Major Incident Management is active and the incident is resolved.
    • Details tab: Presents detailed incident information like short description, assignment details, and related records, with configurable fields.
    • Related Records tab: Lists all records related to the incident, such as task SLAs and affected CIs.
    • Contextual Side Panel: Provides quick access to incident record information, recommendations, expert collaboration via Microsoft Teams, and on-call support for faster resolution.

    Practical Usage for ServiceNow Customers

    • Create and manage incidents directly within SOW, enabling streamlined workflows.
    • Use the Overview tab to quickly assess incident details and update information to aid resolution.
    • Leverage the Investigation tab to analyze CI metrics and execute remedial actions using Playbook, improving issue diagnosis.
    • Communicate effectively with stakeholders through the Communicate tab, ensuring transparency and coordination in incident handling.
    • Generate post-incident reports for major incidents to identify root causes and implement preventive measures.
    • Access detailed and related records information for comprehensive incident context.
    • Collaborate with experts and utilize recommendations from the Contextual side panel to expedite incident resolution.
    • Perform actions such as closing resolved incidents or reopening them if needed within the workspace.
    • Create related tasks like problems, changes, or service requests directly from an incident record to support resolution workflows.

    Key Outcomes

    ServiceNow customers using Incident Management in Service Operations Workspace can expect improved incident resolution efficiency through integrated views, contextual insights, and collaborative tools. The features support comprehensive investigation, proactive communication, and post-incident analysis, leading to better service reliability and customer satisfaction.

    You can create and manage your incidents in Service Operations Workspace.

    Figure 1. Tabs of an incident record page in Service Operations Workspace
    Tabs of an incident record

    Overview tab

    This tab displays the following information about an incident:
    • Summary
    • Impact
    • Cause
    • Resolution

    From the Compose section, you can add comments and work notes for the incident.

    The Overview tab displays the field information along with the field labels, including when you're in read mode.

    For more information on the fields displayed on the Overview tab, see View and update incident information on the Overview tab in SOW.

    You can customize the display of the information on the Overview tab. For more information, see Customize the Overview tab for an incident.

    Investigation tab

    This tab enables you to investigate any affected CIs with the ci_computer or ci_server class associated with the incidents. The tab displays the metrics information of the associated primary CI or any affected CI that is selected, which helps you to analyze and resolve the issue. You can use the various remedial actions on this tab to resolve the CI-related issues.

    By default, the tab displays metrics information of the primary affected CI associated with the incident. But you can also select and view the information for any affected CI with the ci_computer or ci_server class that is associated with the incident. For information about how you can set up Investigation Framework, see Setting up Investigation Framework in Service Operations Workspace.

    Note:
    • The tab is visible only if the Agent Client Collector (ACC) or Microsoft Endpoint Configuration Manager (MECM) adapters are installed and configured.
    • The tab displays the metrics information for the CI only in the following conditions:
      • Agent Client Collector or Microsoft Endpoint Configuration Manager (MECM) is installed for the associated CI. This helps to retrieve the metrics data for the CI.
      • The associated CI class is a CMDB CI computer.
    • This feature supports only the macOS, Windows, and Linux operating systems.

    You can also customize the display of the metrics information on this tab. For more information, see Customize the Investigate tab.

    For more information on the metrics displayed on this tab, see Features of the Investigation tab.

    Communicate tab

    This tab displays all the communication tasks and options that enable you to communicate with the stakeholders in the various phases of an incident. This tab is available only if any of the following conditions are met:For more information on the features of the Communicate tab, see Communicating with stakeholders about incidents and major incidents in SOW.

    Post incident report tab

    This tab enables you to generate, configure, publish, and export a post incident report for a major incident after it's resolved. The post incident report enables you to review the cause and resolution of the major incident and also identify potential process gaps. Based on this information, you can take preventive measures to avoid the issue in the future or to handle the major incident in a better way. This tab is available only if the following conditions are met:For more information on the features of the Post incident report tab, see Review and update a post incident report.

    Details tab

    This tab displays detailed information about the incident. For example, the short description, assignment details, and related records. For more information on how you can configure fields in this tab, see Configure a task record form in Service Operations Workspace.

    Related records tab

    This tab provides a list view of the records associated with the incident. For example, task SLAs and affected CIs.

    Contextual side panel

    From this section, you can view record information and recommendations, collaborate using Microsoft Teams, and reach out to experts on-call to resolve incidents quickly.

    For more information about Incident Management, see Incident Management.