ITSM Quick Reference

Overview

A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.

What problem does it solve? Quick lookup for common ITSM values and operations
Who should use this skill? Anyone working with incidents, changes, or problems
What are the expected outcomes? Faster development with fewer documentation lookups

Prerequisites

Appropriate roles and table access for the operation being performed
A confirmed target instance before making changes

Procedure

Incident Operations

Quick Actions

| Action | MCP Tool | Key Parameters | |--------|----------|----------------| | List incidents | SN-List-Incidents | query, limit | | Create incident | SN-Create-Incident | short_description, caller_id, category | | Update incident | SN-Update-Record | table_name: incident, sys_id, data | | Get incident | SN-Get-Incident | sys_id | | Close incident | SN-Close-Incident | sys_id, resolution_code, resolution_notes | | Assign incident | SN-Assign-Incident | sys_id, assigned_to, assignment_group | | Add work notes | SN-Add-Work-Notes | sys_id, work_notes | | Search incidents | SN-Natural-Language-Search | table: incident, natural language query |

Create Incident

Tool: SN-Create-Incident
Parameters:
  short_description: Unable to access email
  description: User reports Outlook not connecting to server
  caller_id: <user_sys_id>
  category: software
  subcategory: email
  impact: 3
  urgency: 3

Close Incident

Tool: SN-Close-Incident
Parameters:
  sys_id: <incident_sys_id>
  resolution_code: Solved (Permanently)
  resolution_notes: Restarted email service and cleared user cache
  close_notes: User confirmed email is working

Assign Incident

Tool: SN-Assign-Incident
Parameters:
  sys_id: <incident_sys_id>
  assigned_to: <user_sys_id>
  assignment_group: <group_sys_id>

State Values

Incident States

| Value | Label | Description | |-------|-------|-------------| | 1 | New | Newly created, not yet triaged | | 2 | In Progress | Work has started | | 3 | On Hold | Waiting for external input | | 6 | Resolved | Solution implemented, pending verification | | 7 | Closed | Verified and closed | | 8 | Canceled | Canceled (not applicable) |

Change Request States

| Value | Label | Description | |-------|-------|-------------| | -5 | New | Draft state | | -4 | Assess | Assessment phase | | -3 | Authorize | Awaiting authorization | | -2 | Scheduled | Approved and scheduled | | -1 | Implement | Implementation in progress | | 0 | Review | Post-implementation review | | 3 | Closed | Successfully completed | | 4 | Canceled | Change canceled |

Problem States

| Value | Label | Description | |-------|-------|-------------| | 1 | New | Newly identified | | 2 | Assess | Under assessment | | 3 | Root Cause Analysis | Investigating root cause | | 4 | Fix in Progress | Working on permanent fix | | 5 | Resolved | Root cause addressed | | 6 | Closed | Verified and closed | | 7 | Canceled | Problem canceled |

Change Types

| Value | Label | Description | |-------|-------|-------------| | standard | Standard | Pre-approved, low risk | | normal | Normal | Requires CAB approval | | emergency | Emergency | Expedited approval process |

Priority Matrix

Impact x Urgency = Priority

| | Urgency 1 (High) | Urgency 2 (Medium) | Urgency 3 (Low) | |-----------|------------------|---------------------|------------------| | Impact 1 (High) | Priority 1 (Critical) | Priority 2 (High) | Priority 3 (Moderate) | | Impact 2 (Medium) | Priority 2 (High) | Priority 3 (Moderate) | Priority 4 (Low) | | Impact 3 (Low) | Priority 3 (Moderate) | Priority 4 (Low) | Priority 5 (Planning) |

Priority Values

| Value | Label | SLA Target | Description | |-------|-------|------------|-------------| | 1 | Critical | 1 hour | Business critical, widespread impact | | 2 | High | 4 hours | Significant business impact | | 3 | Moderate | 24 hours | Limited business impact | | 4 | Low | 72 hours | Minor inconvenience | | 5 | Planning | No SLA | Future enhancement |

Common Encoded Queries

Incident Queries

| Description | Encoded Query | |-------------|---------------| | Active incidents | active=true | | P1 incidents | priority=1 | | P1 or P2 incidents | priority=1^ORpriority=2 | | Unassigned incidents | assigned_toISEMPTY | | Assigned incidents | assigned_toISNOTEMPTY | | Created today | sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday() | | Created last 7 days | sys_created_on>=javascript:gs.daysAgoStart(7) | | New state | state=1 | | In Progress | state=2 | | Resolved or Closed | state=6^ORstate=7 | | Not Closed | state!=7 | | My incidents | assigned_to=javascript:gs.getUserID() | | My team's incidents | assignment_group=<group_sys_id> | | Contains text | short_descriptionLIKEnetwork | | Starts with | numberSTARTSWITHINC00100 | | Category is network | category=network | | Ordered by priority | ORDERBYpriority | | Ordered by created (newest) | ORDERBYDESCsys_created_on |

Change Request Queries

| Description | Encoded Query | |-------------|---------------| | Emergency changes | type=emergency | | Normal changes | type=normal | | Standard changes | type=standard | | Scheduled changes | state=-2 | | Changes this week | start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek() | | High risk changes | risk=1 | | Pending approval | state=-3^approval!=approved |

Problem Queries

| Description | Encoded Query | |-------------|---------------| | Open problems | state<6 | | Root cause analysis | state=3 | | Known errors | known_error=true | | Problems with workaround | workaroundISNOTEMPTY | | Related to incidents | related_incidentsISNOTEMPTY |

Field Reference

Common Incident Fields

| Field | Type | Description | |-------|------|-------------| | number | String | Auto-generated (INC0010001) | | short_description | String | Brief summary (required) | | description | String | Detailed description | | caller_id | Reference | Reporting user | | opened_by | Reference | User who created record | | assigned_to | Reference | Assigned technician | | assignment_group | Reference | Assigned team | | state | Choice | Current state | | impact | Choice | Business impact (1-3) | | urgency | Choice | Time sensitivity (1-3) | | priority | Choice | Calculated priority (1-5) | | category | Choice | Incident category | | subcategory | Choice | Incident subcategory | | work_notes | Journal | Internal notes | | comments | Journal | Customer-visible notes | | resolution_code | Choice | How resolved | | resolution_notes | String | Resolution details | | close_code | Choice | Closure reason | | close_notes | String | Closure notes | | cmdb_ci | Reference | Configuration item |

Common Change Fields

| Field | Type | Description | |-------|------|-------------| | number | String | Auto-generated (CHG0010001) | | short_description | String | Brief summary | | description | String | Detailed description | | type | Choice | standard/normal/emergency | | state | Choice | Current state | | risk | Choice | Risk level (1-4) | | impact | Choice | Business impact (1-3) | | start_date | DateTime | Planned start | | end_date | DateTime | Planned end | | requested_by | Reference | Requester | | assigned_to | Reference | Change owner | | assignment_group | Reference | Owning team | | cab_required | Boolean | Needs CAB approval | | justification | String | Business justification | | implementation_plan | String | Implementation steps | | backout_plan | String | Rollback procedure | | test_plan | String | Testing steps |

Common Problem Fields

| Field | Type | Description | |-------|------|-------------| | number | String | Auto-generated (PRB0010001) | | short_description | String | Brief summary | | description | String | Detailed description | | state | Choice | Current state | | priority | Choice | Priority (1-5) | | assigned_to | Reference | Problem manager | | assignment_group | Reference | Owning team | | known_error | Boolean | Is known error | | workaround | String | Temporary workaround | | cause_notes | String | Root cause | | fix_notes | String | Permanent fix | | related_incidents | List | Related incidents | | cmdb_ci | Reference | Configuration item |

Resolution Codes

Incident Resolution Codes

| Value | Label | |-------|-------| | Solved (Work Around) | Temporary fix applied | | Solved (Permanently) | Root cause addressed | | Solved Remotely (Work Around) | Remote temporary fix | | Solved Remotely (Permanently) | Remote permanent fix | | Not Solved (Not Reproducible) | Cannot reproduce | | Not Solved (Too Costly) | Fix not cost-effective | | Closed/Resolved by Caller | User resolved |

Close Codes

| Value | Label | |-------|-------| | Solved | Resolved successfully | | Closed/Resolved by Caller | User resolved | | Not Solved (Not Reproducible) | Cannot reproduce | | Closed (Cancelled) | Request withdrawn |

Category Reference

Incident Categories

| Category | Subcategories | |----------|---------------| | hardware | cpu, disk, keyboard, memory, monitor, mouse | | software | email, operating system, application | | network | connectivity, dhcp, dns, firewall, vpn | | database | db2, ms sql server, oracle | | inquiry | request, password reset |

MCP Tools Quick Reference

Incident Tools

| Tool | Purpose | Required Parameters | |------|---------|---------------------| | SN-List-Incidents | Query incidents | - | | SN-Get-Incident | Get single incident | sys_id | | SN-Create-Incident | Create incident | short_description | | SN-Update-Record | Update incident | table_name, sys_id, data | | SN-Close-Incident | Close incident | sys_id, resolution_code | | SN-Assign-Incident | Assign incident | sys_id | | SN-Add-Work-Notes | Add work notes | sys_id, work_notes | | SN-Natural-Language-Search | NL search | table, query |

Generic Tools

| Tool | Purpose | Required Parameters | |------|---------|---------------------| | SN-Query-Table | Query any table | table_name | | SN-Get-Record | Get any record | table_name, sys_id | | SN-Create-Record | Create any record | table_name, data | | SN-Update-Record | Update any record | table_name, sys_id, data |

Common Workflows

Triage New Incident

1. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)
2. Review: Check short_description, category, caller_id
3. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)
4. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)
5. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)

Escalate Incident

1. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)
2. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)
3. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)

Resolve Incident

1. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)
2. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)

Close Incident

1. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)

REST API Endpoints

Table API

| Table | Endpoint | |-------|----------| | Incident | /api/now/table/incident | | Change Request | /api/now/table/change_request | | Problem | /api/now/table/problem | | Task | /api/now/table/task | | User | /api/now/table/sys_user | | Group | /api/now/table/sys_user_group | | CI | /api/now/table/cmdb_ci |

Common Parameters

| Parameter | Description | Example | |-----------|-------------|---------| | sysparm_query | Encoded query | active=true^priority=1 | | sysparm_fields | Fields to return | number,short_description,state | | sysparm_limit | Max records | 100 | | sysparm_offset | Skip records | 50 | | sysparm_display_value | Display values | all, true, false |

Best Practices

Query and verify records before updating them.
Prefer the narrowest table, field list, and encoded query that satisfies the task.
Confirm state and resolution values against the target instance before closing records.

Related Skills

itsm/incident-lifecycle - Full incident lifecycle management
itsm/incident-triage - Detailed triage procedures
itsm/natural-language-queries - Natural language search
admin/generic-crud-operations - Detailed CRUD operations

quick-reference

ITSM Quick Reference

Overview

Prerequisites

Procedure

Incident Operations

Quick Actions

Create Incident

Close Incident

Assign Incident

State Values

Incident States

Change Request States

Problem States

Change Types

Priority Matrix

Impact x Urgency = Priority

Priority Values

Common Encoded Queries

Incident Queries

Change Request Queries

Problem Queries

Field Reference

Common Incident Fields

Common Change Fields

Common Problem Fields

Resolution Codes

Incident Resolution Codes

Close Codes

Category Reference

Incident Categories

MCP Tools Quick Reference

Incident Tools

Generic Tools

Common Workflows

Triage New Incident

Escalate Incident

Resolve Incident

Close Incident

REST API Endpoints

Table API

Common Parameters

Best Practices

Related Skills

References