Please use for the latest documentation.

This site is for reference purposes only and may not be accurate for the latest ServiceNow version

Incident Alert Management

From Wiki Archive
Jump to: navigation, search
Note: This article applies to Fuji and earlier releases. For more current information, see Incident Alert Management at

The ServiceNow Wiki is no longer being updated. Visit for the latest product documentation.


Incident alert management enables organizations to create and manage communications related to major business issues or incidents. This allows incident alert administrators to bring together all involved users during these events and establish quick and easy communication within this group.

For example, a major issue occurs in an organization's server room, leading to a high-priority incident being raised. The incident could potentially impact all users, so it is important to bring together key representatives and communicate quickly and effectively. An incident alert can facilitate this communication process and help resolve the source incident.

Incident alert management is available starting with the Dublin release.

Incident Alert Life Cycle

Error creating thumbnail: Unable to save thumbnail to destination
Incident alerts are created with a New state.

They follow a process that finishes with the Closed or Cancelled state.

A series of rules ensure that the alert progression is controlled and standardized.

  • From New, the state can be changed to Work in progress, Cancelled, or Resolved.
    The state automatically changes from New to Work in Progress if the Actions Taken field is updated.
  • From Work in Progress, the state can be changed to Resolved or Cancelled.
    Only the alert creator or a user with the admin role can cancel an incident alert.
  • From Resolved, the state can be changed to Closed.

For more information, see Processing Incident Alerts.

Example Scenario

An example of how incident alerts can be used in an incident management process is:

  1. An ITIL user creates a high-priority incident regarding a serious issue with the server room.
  2. The incident alert administrator creates a new incident alert for this source incident.
  3. As a result of a conference call discussion, a problem is identified based on the incident. This problem is assigned to the problem management team, which agrees to investigate further and identify tasks to improve service and prevent similar incidents from occurring.
  4. The incident management team resolves the source incident. The source incident may also be closed at this point.
  5. The incident alert administrator resolves the incident alert.
  6. The incident alert administrator convenes a post incident review meeting to ensure that all identified tasks are logged and tracked to completion.
  7. The incident alert administrator can now close the incident alert.

Incident Alert Management Features

You can use the Incident Alert Management application to:


Role Title [Name] Description
ITIL user [itil] Can view the dashboard and incident alerts. Can subscribe to incident alerts.
Incident alert administrator [ia_admin] Can create and edit incident alerts and contact records.

See User Roles for more details.

Menus and Modules

Administrators and incident alert administrators can use all these modules. ITIL users can only use the Open, Resolved and Overview modules.

Incident Alert Management Modules The Incident Alert Management application contains these modules:
  • Create New: Create a new incident alert.
  • My Alerts: View and edit incident alerts where the current user is the incident creator.
  • Open: View and edit active incident alerts, which are not resolved or closed.
  • Resolved: View and edit resolved incident alerts.
  • Closed: View closed incident alerts.
  • All: View and edit all incident alerts.
  • Overview: View a dashboard providing information on all incident alerts.
  • Contact Responsibilities: View and edit contact responsibilities.
  • Contact Definitions: View and edit contact definitions.

Activating Incident Alert Management

Administrators can activate the Incident Alert Management plugin.