[Music] please subscribe to my channel and click on the bell icon to get the regular updates of my channel and do not forget to like comment and share hello everyone welcome to sas with servicenow this is servicenow major incident management tutorial in this video you will learn about major incident management in servicenow and we will start with major incident application in servicenow platform we already know that servicenow has an application incident to manage incident management however servicenow also provides modules in incident application to manage major incident management now this major incident application is not active from the beginning you have to activate it separately in the instance servicenow has a plugin called major incident management which will enable all these different modules of major incident now once it is enabled you can use features of major incident in servicenow platform now let's see all of these modules in servicenow instance this is my service now developer instance now we will go to the incident application so we will type incident now in incident so you have this application and an incident application you will find this module major incidents now all of these modules are related to major incident application so we will start with overview module now this shows the dashboard for major incidents so all different data which basically all the incidents which are major incidents and you can see different kind of metrics like you can see like major incident nearing breach major incidents overview different other reports as well next module is create major incident candidate now users can create or propose for major incident which is called as candidate we will learn about this candidate later in details now next module is create major incident now incident manager can create major incident directly from this module next module is candidates this shows list of all incidents proposed as major incident and not yet converted as major incident next module is open this shows the list of all major incidents which are not closed which are basically active next module is all this shows list of all major incidents including closed ones as well even it is closed or resolved you can still see those major incidents in this list in this module now we have some other modules under administration of incident application which are related to major incident management we will start with here this one major incident trigger rules this is used to create rules for converting incident to major incident candidate so you can create different rules if an incident is created you can just create the rule if that type of incident if it if condition is met whether it can be converted to a major incident candidate or not we will learn about it a little bit more in details the next one is basically major incident properties you can configure different settings for major incident and then finally we have this one which is major incident atf suites now this shows the list of suites created for testing major incident via atf now what are different ways to create a major incident in service now the first way is create major incident candidate in which you propose an incident as a major incident candidate and later can be promoted to a major incident by a major incident manager another way is create a new major incident directly which can be done by major incident manager now what is a major incident candidate and why we need it how exactly this candidate comes into the picture in major incident management process so let's understand it now as we know all major incidents need urgent action from different teams and also need urgent focus from different executive leadership as well however not all the incidents are major incident incident can be of different priority from low to high now if it users wants to create major incident then they have to propose it as a major incident candidate and that proposal becomes a candidate and then major incident manager comes into the picture who reviews the major incident candidate and see that created incident is a legitimate major incident and qualifies all the major incident criteria defined in the organization process now once that major incident manager accepts the candidate then it is promoted to a major incident and then major incident process is initiated so that's how candidate becomes a major incident that means major incident candidate becomes the major incident after approval from major incident manager now let's see what are different ways you can create a major incident candidate in servicenow and the first one is propose major incident button when you enable major incident management then you will find a new button on the form menu on incident which is used to propose an existing incident as a major incident candidate second way is create major incident candidate module an incident application which can directly create a new incident as a major incident candidate and third way is major incident trigger rule which can be defined to create incidents as a major incident candidate if a specified condition is met now let's see all of these different ways directly in service now starting with the first way propose major incident button let's see in my servicenow instance now go to incident application so i will type incident application here i will type incident and then you will see this incident application now open any existing incident which is not a major incident so i will click on this open module it will show me the list of all open incidents so i can pick any incident i want maybe this one now when i will open this you will see this incident form this is an existing incident now how exactly i can propose this incident as a major incident so for that i have to click on this burger icon you will see this context menu in context menu you will see this button called proposed major incident now this is the button which is used to propose existing the current incident to major incident and it will become a candidate because you cannot directly create it because you are just an end user maybe so you can just propose this so that it can be approved or rejected by incident major incident manager now this is the button so i can just click on this now this button is basically accessible to the users with idle role now once you click on this button you will see this pop-up it will ask you for work notes so i can maybe put test no it will ask business impact that why exactly you are proposing so maybe i can i can put a network is is down and then i will click on propose as of now it is not proposed yet but now i will click on propose so this incident will be proposed for a major incident candidate and you will also see a message at the top right here you can see that this incident has been proposed as a major incident candidate now how you will identify that this incident has actually became a candidate for major incident now you will see a difference and that is an extra tab after these three tabs that is major incident tab so when you propose or any incident is a major incident or it is a candidate in that case you will see this fourth tab as major incident which has details related to major incident so here is the state which is the main state for major incident now this state field is different from the main state field which is right here so that's the difference you have to make sure that you know you know that difference that here we have state field this is the major incident state and when you propose an existing incident to a major incident candidate then it becomes proposed that means as of now this incident is still not a major incident and it has been just proposed and you can also maybe mention like business impact is already mentioned which which we mentioned on that pop-up and then we have like probable cause now this is basically information which you will see later as well but overall this is how you can basically create a major incident candidate so this is the first way for creating a major incident candidate as of now we're not talking about the process further that how exactly it gets approved or rejected or converted into incident major incident we will see that later the next way to create a major incident candidate is create major incident candidate module so let's go to the instance now here if you will see under major incidents you will see this module create major incident candidate now this will create and open a new incident form but basically it will come up with that same new tab major incident and as a proposed automatically and if i want to create it so i can just maybe mention here caller i will just mention the caller and then i will just mention test and i will keep as is we don't have to touch this and i can just click on save now this incident will again be proposed as a major incident candidate so initially like the first step the first way was basically for a for an exist existing incident that you can propose an existing incident to to a major incident candidate but here you are directly creating a candidate and it's already proposed so this is the second way so that you can second way of creating a major incident candidate now let's see the third way of creating major incident candidate which is done automatically via trigger rules so in our instance if you will come here here under major incidents you have this administration and then you have this major incident trigger rules if you click this module you will see the list of existing trigger rules created for major incident candidate now what exactly does let me click it again okay we have this list right here so now this rule is basically when an incident is created and if condition is met as per the trigger rule then that incident will automatically become a candidate automatically you don't have to click on propose or you don't have to create it manually it will automatically create so if i if i give an example maybe this one let's see this one this is an existing one uh one more important thing i want to highlight here you can see that it says major incident management application like this record and that is what i want to tell you that major incident management application in the scope service now developed this feature in a scoped application so if you have to do some changes to this you have to change the scope first i can also show you that it is right here then only i will be able to change this so that's another information that major incident application in service now is a scoped application now as of now you can see it is uh inactive but let me let me basically enable this so i'm selecting this now you can see i have selected major incident application scope and here i can mention it as active and here you can say it says priority is critical that means any incident which is critical i want it as a major incident candidate that's a trigger rule so i will just save is save this one and let me check other uh others as well so we only have this one active others are inactive and what i can do let me create an incident so i will start with here we will give select the color here and i will put test for rule and here i will automatically select impact and urgency high so that i can get p1 here and that's it so as of now you can see we only have three tabs no major incident tab and if i click on save let's see if magic happens and if i see here and if i reload this yes you can see here it automatically got converted into major incident candidate automatically why because we do have that trigger rule that's the reason now let's say if i deactivate that because we will see the difference but that's how you can understand the difference so let's say i deactivate this so i will do one thing i'll make it false so we don't have any trigger rule activated and if i create p1 incident again let's see what happens so i'm selecting it here one one and that's it i will click on save let's see what happens so you can see it is created and if i reload this absolutely not you can see we still have three tabs that means this incident is not proposed as a major incident candidate not at all because we do not have any trigger rule activated so nothing ran and that's the reason it is still a normal incident it is not a major incident or a major incident candidate so this is how you can create a major incident candidate in service now with three different ways now we have learned all three different ways of creating major incident candidate and it's up to users and which functionality they want to use now let's understand this whole process because this is just the first step because you have just proposed an incident as a candidate but now what about the actual major incident which comes which basically gets created after approval from a major incident manager and that's what we will see in this demo and we will start this demo by creating some users in my servicenow instance so that i can show you the demo by impersonating different users so let's start with creation of users in my personal developer instance so we will go to the instance here and i will just change this to global and i will go to says underscore user dot list so we will create two users because we will we will try to use a maybe actual example that how exactly uh organization starts a major incident proposal that how exactly user reports the issue which per service how service desk picks up the ticket and gets the call and then how that ticket gets converted into a major incident uh and that's what i will show you in service now so here's the user table and what i will do i will create two users as i said so here mim dot service desk and here i will mention service desk and i think that's it i will just save this and i will also add roles i will click on edit finally i'm not supposed to add a role directly that's not a best practice but this is just a demo so i'm just adding itel to this user so i have created it that's great and now i will create another user so we will create another user and here i will mention this user dot list and i will create another user and that will be mem dot mem dot manager so basically this person is major incident manager so i will mention mim manager and i will just click on save and i will provide two roles to this user not just idle because this user is major incident manager so for that we do have a role and i can find it yes we have right here you can see major incident manager i will select this one and i will now click on save so this two rows are added to this user as well so now we have created two users for this demo now one day all the employees of any organization started facing network issues and no one was able to log into any of the application now one of the employee or multiple employees they called service desk agents sitting at different location and they started getting different calls because it's a big issue it's a big network issue now all those different service desk agents created multiple tickets because they were getting multiple calls now one of them maybe the lead service desk agent you can say created an incident and propose one parent incident as a major incident candidate and in that case major incident manager gets the notification about the candidate and start the review process that's how normally happens so service desk agent creates an incident because uh and proposed that incident as a major incident candidate because it's a big issue because a lot of people are complaining about the network they're not able to connect uh to their different applications and it has a big impact because they're not able to handle maybe their customers and in that case major incident manager comes into the picture as well because they have now proposed the incident as a major incident candidate now how exactly this happens in servicenow system so let's see that so i will go to my instance we will start with impersonating that service desk user so i will impersonate i will mention mim we have service desk i will start from here now i am a service desk user right now i have access to incident application because i have itel user if i type here you can see i have these options but you can see i do not have option to create a major incident directly but i can still create a candidate so if i click on this because as i said maybe i will convert maybe i will convert and propose of basically an existing incident but as i said like there might be multiple incidents multiple calls but in this case i will just create a new candidate because i i do have access so let me create it maybe so i will just select apple tutor and then here i will say network or maybe india india site network is down it is just an example so in that case we already have this major incident what i will do i will just quickly um or maybe i will also uh i will not assign to anyone i will just click on save now as of now i am proposing this what i'm doing that hey i want there's a major incident something has happened because a lot of people are a lot of service desk agents are getting calls from india and there's some issue at the in their network so in that case i have proposed one major incident candidate now this is the one you can see it says proposed by mim service desk this is the user and it shows as proposed when exactly it was proposed now i have not mentioned any business impact and probable cause but i can just mention business impact uh that uh all no one is able to login to uh business applications now i'm just showing you the live example that how exactly it happens in the organization yeah this is not the because i cannot show you the complete uh live scenarios or you can say all the activities of a major incident but i'm just showing you what exactly people can do in service now so this is done i'm clicking on save again so as i said this is proposed now now what will be the next step the next step will be because now the service desk this incident manager should have got some e notification so how exactly i can do that i can see that i will impersonate now that manager so we will impersonate because i want to see what incident has been proposed so i will come here and i will type incident here you can see i have all the access to this application including major incident trigger rules as well and here i will click on candidates now how exactly i can see it because i can see it from here candidates now this is the latest one now these are all i think out of the box one which was already created now this is the one where it says india's site network is down now how exactly i can accept it so i will open this first as a major incident manager i will open this first i will see the data i will see the description i will read the work notes what what issues they have maybe it it might have more details i will read the business impact this is more important now i think okay nobody's able to log into business application it's a big issue it is a major incident now how will i accept this so a major incident manager can accept this by going to this burger icon and now we have these options promote to major incident but i still want to tell you one thing let's say if this does not let it is maybe it's not a legitimate major incident then i can also reject it but this time it is definitely a legitimate major incident and i will click on promote to major incident and if i click this button you will see that that this incident will be promoted to major incident but here it is also asking me to provide a work node so accepted this as mem and i will click on and i think as a major incident manager i can also mention initiating mem process and communication communication i can just mention here and i can just click on promote maybe if i have more details about business impact i can also mention that else i can just click on promote and once you click on that you can see it says this incident has been promoted to a major incident now you can call this incident as a major incident it's not a candidate anymore this is an actual major incident and then different teams major incident manager and stakeholders they will trigger the process they will involve different teams and resolve this one important thing you have seen that is assignment group assignment group was empty but here you can see that it got automatically assigned to major incident management now this is also something you can change with the help of properties we have available in service now and that is basically as of now i'm i'm from uh i have this mem access that's the reason i don't have admin because those properties can be changed by admins only but here you can see that uh all the details it is accepted promoted by this and you can see the promoted date and then you can see like business impact if you remember it used to mention about proposed buy but now it is accepted so it is showing you the details related to promotion not related to proposal that's the important thing you can see here so this is how a major incident management process works in service now that's how this tool supports the major incident management process that you can convert so once that incident is proposed as a candidate that means for major candidate and then major incident manager can accept it and that incident will be treated as a major incident and then we can initiate we can we can initiate the major incident management process we can basically call different teams bring teams on the call and tell them that he has to resolve the issues whatever concern teams we have to just pull them send sms send calls uh pull them in a different call in in a conference call and just resolve the issue as soon as possible and as a major incident manager we also need to communicate to the different stakeholders and that's the main thing for a major incident manager as well now as you have multiple incidents created in a specific event where multiple incidents were created for a for a particular issue and you cannot make all the incidents as a major incident because they were related to the same incident same type of incident so in that case what you can do you can associate multiple incidents with a major incident how you can do that let's see that in service now so i can go to uh maybe i can just open this one and i can i think i can just go to open one and here but in this case i have to select right here let me open this one it says all maybe you have to open this one okay i will select these three i will select here and absolutely it says link to major incidents two of two of two of three so maybe i will just cancel this one and maybe i will select uh let's see this one and this one and if i select this and if i select here link to major incident one of two so if i select this it says which major incident and if i select any one major incident now these are all major incident let's say i select this one and if i click on ok this is the main major incident which we just created uh selected incidents were added as child incident to the major incident this one so i click on this one and you can see we have this as child incident you can see here now we have seen that we selected two incidents but only one was one was selected so i think you can do single one but i think there is also a feature you can do multiple as well if i'm not wrong uh you can do that but why it didn't work maybe let me check again if i select this one and if i select here it says link to major incident maybe there was some condition uh and and maybe it was a candidate that's the reason but now here you can see i can link both of them to major incident and i have this one again i will click on ok i'm sure these two will be associated with the major incident okay very good i will click on here and if i go at the bottom absolutely this time we got all three incidents associated with this major incident and they became the child because this situation will definitely come because during major incident you might have multiple incidents related to the same incident in that case if even if i talk about the ideal process you cannot have multiple major incidents you can just have one parent incidence and you can make all other incidents as a child incident but that's how you can link all those different incidents with this major incident you saw that we accepted the major incident candidate but now we will see that how exactly a major incident manager can reject multiple major incident candidates so let's go to the instance and we already have impersonated with mem manager so in that case what i will do i will just open maybe candidates because this shows the list of all the candidates now how exactly i can reject them together so maybe i see okay these two are not a major incident candidate let's see i will just select them i will select here and here i will just see this one reject major incident candidates if i do this if i click on reject you will not see them in this list so i will submit test click on reject done so that means you have rejected these two incidents from a major incident candidate and if i refresh this list yeah you can see here we only have three incidents now which are proposed as major incident candidate and we have already rejected other two let's see how you can demote a major incident that means we already have a major incident created you have maybe you have already promoted it to a major incident but how can you demute it maybe you have you have promoted it by mistake maybe after five minutes you came to know that hey there was not actually a major incident so in that case how can you demote it so let's go to the instance and we have to open open major incident basically and let's see this one is the same one in india site network is down in that case i have to uh demote this one so in that case i can click on this one like here right click or on this burger icon and we have this button called demote major incident now you will only see this button if this incident is a major incident so i will click on this if i will click on this i'm sure i will give it get a pop-up i will mention test and if i click on ok this will not be major incident anymore you can see here major incident state cancelled not at all this is not major incident anymore and you can see the message here as well this incident is no longer a major incident i can also promote it again if i want and i can also propose it but what i will show you now i will show you the basically rejection one so we rejected multiple uh major incident candidates while list view but now i will show you from the form as well so maybe i will quickly propose this i will propose as a candidate i will click on propose and once it is proposed i can go to this bill icon again and here we have this button called reject major incident candidate and if i click on this it will be rejected again so this is not absolutely you can see it's rejected so it says this has been rejected this is not major incident and if i go to open one you can see that india site one it is not available here in this list that means that incident is not at all a major incident or a major incident candidate even it should not be available here as well you can see it's not not also available in this list because it is not a major incident candidate major incident information on incident let's see what different informations you can see on incident form related to major incident so we will go to the incidents in instance now here you can see we have three major ins now these are proposed one so maybe i will quickly show you for the proposed one first so let's open this one now this is just proposed now this proposed one shows state major incident state business impact probable cause proposed by and then proposed time date and time now let's say if it is a major incident and if i go to major incident let's see here and here you can see we have again same this will not change but now we have promoted by and promoted the time so these fields definitely have changed if that incident is a major incident that means it was promoted to a major incident these are the details related to major incident on a mage on incident on an incident form next is what is post incident report post incident report shows the information provided by resolving team like overview findings and timelines and other information like impacted services outage records affected locations incident timelines etc you can get the option to create this report when state of the incident is resolved so now let's go to the instance and see where exactly you can see this post incident report option so basically if i open this list and let's open any existing major incident so let's say this one if i open this one i will not see anything related to post incident report but let's say if i resolve this let's try to resolve if i i click on resolve and i will fill these information test and now if i click on resolve so let's see so that email server down is resolved but now what you will what difference you will see on the form let's open it if i open this and if it's a major incident the major difference you will see the new tab and that is post incident report because once incident is resolved now let's say i am a resolving team or maybe i am a major incident manager in that case i have to put all these details like you can see the overview that what exactly happened uh what was the issue findings and then here you can mention the timelines that what action we're taking on what particular time that you can mention here now these are the details related to post incident report but is it the only post incident report that this is the this is the data you can see not at all because this is not the report you can generate that report so for that you go a little bit down and here you have preview pir if i click on this it shows me the exact post incident report what all the information for post incident report and here it says email server is down this is created this is a priority category duration impacted services timelines overview it's the same data which will be pulled from that tab details impacted services all those different information and you can see the timelines here as well now if you have to share this report because as of now i have just clicked to see the preview but now how can i generate it so you can just click on download report pdf this will be exported and you can see this report and you can also share this report with different stakeholders it's up to you that what stakeholders you want to share this this report that's how you can create a post incident report which will have a lot of details related to that incident now post incident report is not a root cause analysis report that is the difference you have to understand post incident report is just that after incident analysis that what was the timeline when that action was taken all those things but root cause problem analysis root cause analysis it's totally different that comes under problem management that's not part of major incident management that comes under problem management so thank you for watching this video have a great day