Process Incidents

tip

Role required: incident_manager.

This section focuses on how incidents are processed by agents. The following diagram shows the incident state model.

note

Infrastructure incidents cannot have the Rejected by user and Information needed states.

State Flow and Waiting states

The states of incident processing can be divided into:

• State Flow. When an incident is in a State Flow state, such as In progress, SLA indicators count down the time related to the incident processing until the SLA is breached.
• Waiting. When an incident is moved to a Waiting state, such as Information needed, all SLA indicators related to the incident stop the countdown.

State Flow

---

The State Flow group includes the following procedures and states.

Procedure	State	Description	Available Transitions
Logging	Registered	The incident is recorded (via phone/email/Self-Service Portal) but not yet categorized.	Assigned In progress
Categorization	Assigned	The incident is categorized and assigned to a relevant person or a group.	In progress Information needed Completed
Diagnosis and Resolution	In progress	An agent started working on the issue.	Assigned Postponed Information needed External processing Completed
Closure	Completed	An incident is resolved when the agent provides temporary workarounds or permanent solutions. The agent changes the state to Completed so that the caller could assess the results. The caller receives a notification asking to evaluate the agent's job and the service level. If the user is satisfied with the solution, the incident is marked as Closed; otherwise, it is Rejected by user.	Assigned In progress Rejected by user Closed
Closure	Closed	If an incident is not closed after it was marked as Completed, it will be closed automatically over an adjustable time frame as set in system properties.

note

Only the incident caller has the right to close the incident. However, this rule does not affect infrastructure incidents. The incidents of this type can be closed only by the responsible agent after examination.

Waiting

---

The Waiting group includes the following procedures and states.

Procedure	State	Description	Available Transitions
Diagnosis and Resolution	Information needed	If the issue description is not clear enough, the agent can request additional information by changing the incident state to Information needed. Once the information is received, the agent should change the state to the previous one.	Assigned In progress Postponed External processing
Diagnosis and Resolution	Postponed	The incident can be marked Postponed if resolving the incident has to be postponed for a certain period. If the incident moves to this state, the agent must specify the date they plan to resume the work on the incident in the Resumption of work field. However, if the incident affects business functions, they should at least provide a temporary workaround.	In progress Information needed External processing
Functional escalation	External processing	If resolving the incident requires involving a third party, after the reassignment, the incident state should be changed to External processing. After the third party involvement is over, the agent should change the incident state and the assigned user to the previous ones.	In progress Postponed Information needed Completed
Resolution	Rejected by user	If the caller is not satisfied with the agent's work on the incident, they can change the state to Rejected by user to further address the defects.	Assigned In progress Completed

Assign and update incidents

Once the incident is registered, it should be assigned to a responsible person or group for further processing. To assign an incident, complete the following steps:

1. Navigate to Incident Management → All Incidents and open the incident you want to assign.
2. Select a user to assign the incident to in the Assigned user field, by clicking the magnifier icon .
3. (optional) Complete the same step for the Assignment group field.

There is also a quick way to assign an incident to a current user. To do so, click the Start work button in the right top corner to become the Assigned user. The incident state changes to In progress automatically. The Assignment group field remains unchanged (either with a group specified or empty). This button is available for all users who are not assigned to the service request and who have the ITSM_agent role, or belong to the assigned group.

To make any updates to the incident, complete the following steps:

1. Open an incident to work on.
2. Change the necessary fields.
3. Click Save or Save and exit to apply the changes.

Your changes will be displayed in the Activity Feed, in history. The following information is displayed:

1. Who initiated the update
2. Updated field
3. New field value
4. Previous field value

Activity view

Escalation rules

There are two possible types of escalation:

• Functional. When the 1st level service agents cannot solve an incident for some reason (lack of authority or competence), they escalate it to the 2nd level service agents.
• Hierarchical. This escalation is typically required when an incident is of a serious nature, or a set of incidents may take a lot of time. An issue can be escalated up to the management.

Closure information

Based on the SimpleOne state model, when an incident is resolved, it should be marked as Completed, which denotes the incident closure. Also, the agent must provide the following details:

• Closure code
• Closure notes

Closure code

This code specifies an option for the closure.

Option	Description
Solved 1st level	Service agents of the 1st level solved the incident without functional escalation.
Solved 2nd level	Service agents of the 2nd level solved the incident (service agents of the 1st level were unable to solve it).
Not solved (Refused)	Agents could not reproduce the incident and did not find any disfunction.
Not solved (Dropped)	When the request is not an incident but, for example, a change request.
Not solved (No user reaction)	When a user did not provide additional information during the Information needed phase.
Not solved (Other)	For all other reasons.
Not solved (Workaround)	The incident has no permanent solution, but has a temporary workaround related to a known error.

Closure Notes

In the Closure notes field, add information on the work performed, and other information related to this incident.

Process infrastructure incidents

Since infrastructure incidents are created without the involvement of a business user, their state model is different from other incidents. Infrastructure incidents do not have the Information needed and Rejected by user states. When such incidents are closed, it is not required to fill in the Agent satisfaction and Service satisfaction fields.