How to Create an Incident in ServiceNow Step by Step
Recommended Learning Path
How to Create an Incident in ServiceNow
Step by Step
Table of Contents
Creating an Incident record is one of the first practical tasks learners perform while studying ServiceNow ITSM.
An Incident is used when an IT service is unexpectedly interrupted or its quality is reduced. Examples include a user being unable to access email, a VPN connection failing, or an important application becoming unavailable.
If you are learning servicenow change management the important skill is not simply clicking Submit. You should understand what information belongs in each field and why it matters to the support process.
Quick Answer: How Do You Create an Incident in ServiceNow?
For an ITIL agent using the standard ServiceNow interface, the basic path is:
All → Incident → Create New
Complete the appropriate Incident fields and select Submit.
ServiceNow’s current documentation also allows users with appropriate roles to select New from an Incident list. The exact form may differ because organisations can configure Incident forms according to their own processes.
Start Your Data Analytics Journey
What Do You Need Before Creating an Incident?
ServiceNow’s current documentation lists itil, sn_incident_write, or admin among the roles that can create incidents through the standard Incident form.
You should also have enough information to explain the issue clearly.
For example, instead of:
“VPN not working”
collect useful context such as:
“Employee cannot connect to corporate VPN after entering credentials. Error started at 9:15 AM and affects only this user.”
Clear information makes categorization, assignment, and investigation easier.
Step 1: Open the Incident Form
Log in to your ServiceNow instance.
Navigate to:
All → Incident → Create New
Alternatively, open an Incident list and select New.
ServiceNow officially documents both methods.
A blank Incident form opens.
The Incident Number is normally generated by the system, so you generally do not need to create the number manually.
Step 2: Select the Caller
The Caller represents the user who reported the issue.
Suppose an employee named Ravi reports that his VPN is failing.
Select Ravi in the Caller field.
This helps support teams identify who is affected and can also provide related user information depending on the organisation’s configuration.
ServiceNow defines Caller as the user who contacted the support team with the issue.
Step 3: Select Category and Subcategory
Categorization describes the type of issue being reported.
For a VPN failure, an example could be:
Category: Network
Subcategory: VPN
The values available depend on how the organisation has configured its Incident form.
Accurate categorization can support routing, reporting, trend analysis, and later Problem Management.
Avoid selecting a category randomly just to complete the form.
Step 4: Identify the Affected Service or Configuration Item
If the affected service or technical component is known, select the relevant Service, Service Offering, or Configuration Item (CI) where appropriate.
A CI could represent something such as a server, laptop, application, or network device.
ServiceNow documentation notes that selecting a Configuration Item can provide service and dependency context and can also influence assignment when appropriate configuration data is available.
For beginners, the important question is:
What service or component is actually affected?
Do not select a CI simply because the field exists.
Step 5: Write a Clear Short Description
The Short Description should summarize the problem in one clear line.
Poor example:
“Issue”
Better example:
“Unable to connect to corporate VPN after login”
A strong Short Description lets an agent understand the incident quickly without first opening every detail.
Step 6: Add a Useful Description
The Description should provide enough information for investigation.
For example:
User is unable to connect to the corporate VPN from the company laptop. The issue started around 9:15 AM. Internet access works normally, but VPN login returns an authentication error. The user restarted the laptop and retried the connection.
Useful details can include:
- what the user was trying to do,
- what actually happened,
- error messages,
- when the problem started,
- who is affected,
- and troubleshooting already attempted.
Avoid unnecessarily long descriptions, but provide enough context for another support agent to continue the investigation.
Step 7: Set Impact and Urgency Carefully
Two important Incident fields are Impact and Urgency.
Impact describes how significantly the incident affects business operations.
Urgency describes how long resolution can reasonably be delayed before business impact becomes significant.
ServiceNow states that Priority is based on Impact and Urgency and indicates how quickly the service desk should address the task.
For example, an issue affecting one employee may have lower impact than an outage affecting an entire department.
Do not automatically select the highest Impact and Urgency values.
Step 8: Check the Priority
Once Impact and Urgency are set, review the resulting Priority.
A simplified way to understand the fields is:
Field | Question |
Impact | How much of the business is affected? |
Urgency | How quickly does this need attention? |
Priority | How quickly should support respond? |
The exact priority rules can be configured by the organisation, so beginners should learn the logic rather than memorising one universal matrix.
Step 9: Select the Assignment Group
The Assignment Group identifies the team responsible for working on the incident.
Examples might include:
- Network Support
- Service Desk
- Database Support
- Windows Support
- Application Support
For a VPN issue, the appropriate group might be Network Support, depending on the organisation’s setup.
ServiceNow can also populate Assignment Group based on information such as a Configuration Item or Service Offering when the relevant rules and data are configured.
Step 10: Select Assigned To When Appropriate
Assigned To identifies the individual agent responsible for working on the incident.
A useful distinction is:
Assignment Group = responsible team
Assigned To = responsible individual
The Incident may initially be sent to a group and later assigned to a specific agent.
ServiceNow notes that changing the Assignment Group can clear the Assigned To value, helping prevent an agent from remaining assigned when the responsible team changes.
Step 11: Add Attachments When They Help
Screenshots, error messages, or relevant files can provide useful troubleshooting context.
ServiceNow’s standard Incident form supports attachments.
For example, if the user sees a VPN authentication error, attaching a screenshot can help the support agent understand exactly what occurred.
Do not attach unnecessary or sensitive information that is not required for support.
Step 12: Review and Submit the Incident
Before selecting Submit, review the record.
Check that:
- the correct Caller is selected,
- Category and Subcategory make sense,
- the issue description is clear,
- Impact and Urgency reflect the situation,
- Priority looks reasonable,
- the correct support group is selected,
- and any useful CI or attachment has been added.
Then select Submit.
ServiceNow creates the Incident record and assigns its system-generated Incident Number.
Practical Example: Creating a VPN Incident
Imagine this scenario:
User: Anjali
Issue: Unable to access corporate VPN
Affected users: One
Error: Authentication failed
A sample record could look like:
Field | Example |
Caller | Anjali |
Category | Network |
Subcategory | VPN |
Short Description | Unable to connect to corporate VPN |
Description | Authentication error appears after entering valid credentials |
Impact | Based on actual business impact |
Urgency | Based on how quickly service is required |
Assignment Group | Network Support |
State | New |
The exact choices may differ in your instance.
The important skill is understanding why each value was chosen.
How Do You Validate a Newly Created Incident?
Creating the record is only half the exercise.
After submission, reopen the incident and validate it.
Check whether the Incident Number was generated, the Caller and descriptions were saved correctly, Priority reflects Impact and Urgency, and the incident reached the expected Assignment Group.
Also confirm that the initial State is appropriate and that related SLAs, notifications, or routing rules behave as expected if your training instance has them configured.
Testing is especially important when administrators have customized forms, Business Rules, Assignment Rules, UI Policies, or Flows.
Get Ready for Data Analytics Interviews
Creating an Incident in Service Operations Workspace
ServiceNow also provides Service Operations Workspace for agents.
Current documentation allows agents to create an Incident from the workspace’s list navigation, an existing Incident list, or an Interaction. The workspace form includes fields such as Short Description, Description, Caller, Location, Channel, State, Impact, Urgency, and Priority.
The screen may look different from the standard interface, but the underlying Incident Management concepts remain similar.
Common Beginner Mistakes
Do not create vague Short Descriptions such as “system problem.” Explain which service is affected.
Do not mark every incident as high priority. Impact and Urgency should reflect the actual situation.
Avoid assigning an incident to a random team. Categorization and assignment should reflect the affected service.
Another common mistake is submitting the form without testing the created record. Always reopen it and verify that the expected data, routing, and priority were applied.
Build Your Learning Plan Around Practice
Practise with increasingly realistic scenarios.
Start with:
Single user cannot connect to VPN
Then try:
Entire department cannot access email
Next, create an incident that requires reassignment, SLA tracking, or a related Problem.
Use this learning cycle:
Create → Classify → Prioritize → Assign → Validate
This helps turn a basic ServiceNow tutorial into genuine Incident Management practice.
The FLM ServiceNow course currently includes a practical Incident Management project covering incident lifecycle work, customized forms, and field conditions.
FLM Perspective: Capture the Right Information First
A useful beginner framework is:
Who → What → Impact → Owner → Check
Who: Who reported or is affected by the issue?
What: Which service failed and what happened?
Impact: How serious and urgent is it?
Owner: Which team should investigate?
Check: Was the record created and routed correctly?
A well-created Incident gives the support team a better starting point for restoration.
Related Career Guides
- What Is ServiceNow? A Beginner’s Guide – Understand the overall platform.
- What Is IT Service Management (ITSM)? – Learn the wider ITSM approach.
- What Is ServiceNow ITSM? – Understand connected ITSM processes.
- What Is Incident Management in ServiceNow? – Learn the full Incident lifecycle.
- What Is Problem Management in ServiceNow? – Understand what happens when incidents recurting.
Conclusion
Creating an Incident in ServiceNow is simple at the interface level, but creating a useful Incident record requires more thought.
Choose the correct Caller, classify the issue, describe it clearly, evaluate Impact and Urgency, confirm Priority, route it to the right team, and verify the result after submission.
Once you can create and validate incidents confidently, you can move into investigation, SLAs, escalation, Problem Management, Change Management, and Incident automation.
Frequently Asked Questions
How do I create an Incident in ServiceNow?
For the standard agent interface, navigate to All → Incident → Create New, complete the required fields, and select Submit.
Who can create an Incident?
ServiceNow’s current standard-form documentation lists itil, sn_incident_write, or admin as roles that can create Incident records through that procedure.
What should I enter in Short Description?
Write a concise explanation of the affected service and issue, such as “Unable to connect to corporate VPN.”
What is the difference between Impact and Urgency?
Impact represents the effect on business processes. Urgency represents how long resolution can be delayed before significant business impact occurs.
How is Incident Priority determined?
ServiceNow states that Priority is based on Impact and Urgency, although organisations can configure their prioritization logic.
What is Assignment Group?
It identifies the support team responsible for working on the Incident.
What is Assigned To?
It identifies the individual agent working on the Incident.
Can ServiceNow create Incidents automatically?
Yes. Depending on configuration, incidents can also originate from sources such as email, Service Catalog, monitoring, external applications, or automation rather than only manual form entry.
Build Your Future as a Data Analyst
Learn How to Become a Data Analyst