--- title: Create an incident description: Create an incident record to document a deviation from an expected standard of operation. locale: en-US canonical_url: https://www.servicenow.com/docs/r/it-service-management/incident-management/create-an-incident.html release: brazil product: Incident Management classification: incident-management topic_type: task last_updated: "2026-09-10" reading_time_minutes: 7 breadcrumb: [Managing incidents, Incident Management, IT Service Management] --- # Create an incident Create an incident record to document a deviation from an expected standard of operation. ## Before you begin Role required: itil, sn\_incident\_write, or admin ## About this task Agents with the itil role complete the Incident form to log incidents. Incidents are also logged when a user fills out a record producer in the service catalog, or sends an email to the instance. ## Procedure 1. Navigate to **All** > **Incident** > **Create New**. You can also select **New** from the Incident list view. **Note:** If the **Incident** module is not visible in the **All** menu, contact your administrator to verify that the itil or sn\_incident\_write role is assigned to you. 2. Use a template if one exists for the type of incident that you are logging. If the organization uses form templates, then you can apply a template to pre-populate some of the fields for specific types of incidents. For more information, see [Use a template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/t_UseATemplateFromAForm.md) 3. On the form, fill in the fields. Your organization has configured the Incident form to adhere to its incident management process. The information that you enter in the form fields depends on that process. The following table describes typical Incident form fields.
Field Description
Number Unique system-generated incident number.
Caller User who contacted you with an issue.
Category and Subcategory Type of issue. After selecting the category, select the subcategory, if applicable.
Service Affected business service, if applicable. **Note:** If the selected business service is also a configuration item in another active task, the active tasks icon \[Omitted image "other-active-task.png"\] Alt text: appears. Select the icon to view all active tasks affecting the business service. You can view the BSM map \(dependency view\) of the selected business service by selecting the dependency icon \[Omitted image "dependency-icon-r.png"\] Alt text:.
Service Offering Service offering consists of one or more service commitments that uniquely define the level of service in terms of availability, scope, pricing, and packaging options. This field enables you to receive different features and their levels of performance for a given service.
Configuration item Affected CI, if applicable.After a CI is selected, you can select the Dependency views icon \[Omitted image "dependency-icon-r.png"\] Alt text: next to the field to see how the CI maps into the infrastructure. The dependency view shows you what is impacted and whether other CIs or services are experiencing issues. To capture information on the affected CIs, refer to [Capture information on affected configuration items](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/track-ci.md). Search results in the **Configuration item** field display a list of configuration items \(CI\). Results are sorted alphabetically by CI name.
Channel Communication method that is used by the user to create the incident. The available options are:- Chat - Email - Phone - Monitoring - Self-service - Virtual agent - Walk-in
Origin Source of the incident. For example, if an incident is created from alert, this field contains the value Alert. This field is auto-populated and can't be edited manually.
State State of the incident. The state moves and tracks incidents through several stages of resolution.**Tip:** Use the **State** field, rather than the **Incident State** or **Problem State** fields, as your primary means of tracking the state of an incident because this state progresses through the entire processing cycle. To learn more, see [Incident life cycle](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/c_IncidentManagementStateModel.md).
Impact Measure of the effect of an incident on business processes.
Urgency Measure of how long the resolution can be delayed until an incident has a significant business impact.
Priority Value based on impact and urgency that identifies how quickly the service desk should address the task. This value is calculated based on the selected values in the **Impact** and **Urgency** field.**Note:** When you initially create and save an incident, the **Work notes** field isn't required. If you change the priority of the incident by selecting different **Impact** or **Urgency** values on an incident form that was saved, the **Work notes** field becomes required.
Assignment group Group that works on the incident. The business rule **Populate Assignment Group based on CI/SO** populates the **Assignment group** field based on the support group available for the configuration item \(CI\) or the Service offering consecutively. **Note:** The business rule is triggered when an incident is created or updated, and when the **Assignment group** and the **Assigned to** fields are empty. To override the default value, create new properties and provide the field in the property value that must be used to populate the **Assignment group** field. Create the properties in the following order of preference: - **com.snc.incident.ci\_assignment\_group.field\_name**: Identifies which CI field populates the **Assignment group** field. - **com.snc.incident.service\_offering\_assignment\_group.field\_name**: Identifies which service offering field populates the **Assignment group** field. **Note:** - The sys\_user\_group **read** ACL calls the SNCRoleUtil function. The function verifies whether the group that is reviewed contains either the admin role or security\_admin role. The function enables the user to view the group only if the user has the same role. As a result, a user with the itil role cannot assign an incident to a group that has the admin role or security\_admin role. This restriction also applies to any group whose parent has those roles. - Other than using the read ACLs, you can also restrict incidents with specific assignment groups for visibility only to the group members using before-query business rule. For details, see [How to restrict a specific group incidents to only its group members \[KB0790987\]](https://support.servicenow.com/nav_to.do?uri=%2Fkb%3Fid%3Dkb_article_view%26sysparm_article%3DKB0790987) article in the Now Support Knowledge Base. You must log in to view the article.
Assigned to User who works on this incident. If the **Assignment group** changes, the **Assigned to** field is cleared.
Short description Brief description of the incident.
Description Detailed explanation on the incident.
Attachments Attachments related to the incident that help resolve the incident, such as screenshots or PDF files. Select the attachment icon \[Omitted image "attachments-icon.png"\] Alt text: to add and manage the attachments.
Notes
Watch list Users who receive notifications about this incident when comments are added. Select the add me icon \[Omitted image "add-me.png"\] Alt text: to add yourself to the watch list.
Work notes list Users who receive notifications about this incident when work notes are added. Select the add me icon \[Omitted image "add-me.png"\] Alt text: to add yourself to the work notes list.**Note:** The administrator must create an email notification for the work notes list.
Additional comments \(Customer visible\) More information about the issue as needed. All users who can view incidents, including the customer, can see additional comments.
Work notes Information about how to resolve the incident, or steps taken to resolve it, if applicable.**Note:** Only the internal users who are involved and responsible for working and resolving the incidents can view the work notes.
Actions taken Journal field for details of the actions taken for a major incident. This field is visible only to internal users. **Note:** This field is only visible when you activate the Major Incident Management plugin \(com.snc.incident.mim\).
Related Records
Parent Incident Unique number of the parent incident for this incident record.
Problem Unique number of any problem record related to the incident.
Change Request Unique number of any change request related to the incident.
Caused by Change Unique number of the change request that resulted in the creation of the incident.
**Note:** The **Caller** and **Company** fields are optional for the following situations: - An incident is created from an alert. - An incident is created from a change request. In such case, the change request number is populated in the **Caused by Change** field. 4. Select **Submit**. ## Result The incident is created. ## What to do next Use the incident form to perform multiple actions to work and resolve the incidents. For more information, see [Working with the incident record form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/working-incident-record-form.md). **Parent Topic:**[Managing incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/work-on-incidents.md) **Related topics** [Create a record from an incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/t_PromoteAnIncident.md) [Managing major incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-service-management/incident-management/major-incident-management.md)