product icon

Create Incidents

You can create new incidents using the web app, the customer portal, or email integration.

An incident is a single event, disturbance or query that affects the quality of a service to a customer. When a customer is affected by an incident which is then resolved, the service for that customer is restored to normal levels. Incidents can be logged by technicians, and administrators can allow customers to submit incidents as well using the Customer Portal. Because incident management focuses on getting the customer back on track as quickly as possible, fixes for incidents are often "band-aid" fixes and do not always allow the underlying root cause to be further explored and resolved.

Incidents and their associated data are automatically archived 2 years from the date they were last updated (e.g., reopened, comment added, etc.), then removed from our system 1 year from the date they were archived. For more information, please see About Automatic Incident Data Archival.

Incidents can be created in any of the following ways:

If needed, agents can also hide notifications to customers when updates are made to incidents they have submitted.

Create an incident via the web app

Agents can log in to the Service Desk web app to create and track incidents.

1. Log in with your email address and password at

2. Go to Incident > New Incident.

3. Select the service under which the incident should be created.

4. A new record form is created whenever an incident is added to a service. Incident records use the same basic layout as other record forms and can be filled out (see within "Summary" through "Time" sections below).

5. Click Save when finished.


The summary section lists all the basic information about the record, including the following:

  • Service – The service to which the record belongs
  • Record ID – The individual ID used to distinguish between records
  • Owner – The technician who created the record
  • Title – The title of the record
  • Assignee – The technician to whom the record is assigned
  • Priority – The priority level assigned to the record
  • Resolve by – The estimated resolution date automatically calculated using the priority level and non-working days; click the calendar date to see the SLA (incidents only)

Incident Details tab & Status

Note:  The maximum file size for uploading attachments is 50 MB.

The Incident Details tab lists all the content needed for development to be done, including the following:

  • Type – The record's type (as configured by an administrator under service settings)
  • Category – The record's category (as configured by an administrator under service settings)
  • Occurrence – The date and time that the incident occurred
  • Custom Fields – Any custom fields created under service settings
  • Symptom – A space to explain the symptoms and business impact caused by the bug
  • Discussion – A space to include any further details, discuss the development of the record and include updates as development continues; comments can be prevented from appearing in the Customer Portal by selecting the "Hide from customers" check box.
    Note: Account admins can click Delete to permanently remove a technician and/or customer comment.
  • Resolution – A space to explain the record's resolution (i.e., how it was fixed or not fixed), as well as "Not Resolved" and "Resolved" options.
  • Assignee – The technician to whom the record is assigned
  • Watchers – The watchlist is a list of individuals and groups who are "watching" a particular record (click x person watching. Invite more... link to modify list); when the "Notify watchlisted" check box is selected when a record is saved, watchlisted individuals and groups receive notifications about the changes
  • Notify watchlisted – When this box is selected, all watchlisted individuals will receive a notification about the changes; in addition, technicians can add a particular group to receive the notification on a per-record basis (without being added to the watchlist)
  • Close – Closing a record means that there is no more work to be done and the record is completely finished

Tasks tab

Note:  The maximum file size for uploading attachments is 50 MB.

Each record can have an unlimited number of tasks assigned to it. See Add Tasks for more information.

Linked Items

Service Desk allows records to be linked to customers, configuration items and other records. This helps ensure that related items are easily visible and the connections between them and other items within Service Desk are visible.

  • Link customers – Use the search box to find and select customers who are affected by or related to the record (only 1 customer may be linked to each record).
  • Link incidents – Click the Add icon to link related incidents to the record, then select "search existing" or "create new." There is also an option to include the incident's symptom and resolution within the link (visible by clicking it).
  • Link problems – Click the Add icon to link related problems to the record, then select "search existing" or "create new." There is also an option to include the problem’s symptom and resolution within the link (visible by clicking it).
  • Link knowledge articles – Click the Add icon to link related knowledge articles to the record, then select "search existing" or "create new." There is also an option to include the knowledge article's discussion and resolution within the link (visible by clicking it).
  • Link changes – Click the Add icon to link related changes to the record, then select "search existing" or "create new."
  • Link releases – Click the Add icon to link related releases to the record, then select "search existing" or "create new."
  • Link affected items – The affected items section automatically includes the record's service and linked customers; in addition, related configuration items (CIs) can be linked by clicking the Add icon .


Tags are arbitrary labels that can be added to any record using the text field.

Technicians can click a tag to see a list of results that includes all records with that tag, which can be filtered by state and service.

The activity log is a list of all actions and changes (e.g., status, tasks, email notifications, mass actions, etc.) that have occurred for a service record. Technicians can click View Allto view all of the entries in an activity log, and even click Print to print the service record's history.

Additionally, if an external watchlist user was notified via email for a problem, the technician can click Remove External Email Activity in their incident activity log, then search for the external watchlist user's email address, check the box to select it, and click Remove to permanently remove the email address of that external user from the problem activity log.

Within the Activity pane, email notification delivery alerts are displayed to inform technicians if an email notification failed to be delivered to a user, customer, or person that is enabled on the watchlist.

When viewing the undelivered email notifications alert, the following is displayed:
  • Email address of the user, customer, or person
  • Status (e.g., bounce, delivered, etc.)
  • Reason (if undelivered)
  • Count (number of emails sent)

You can click on any of the fields listed above to view the changes that were attempted to be sent within the undelivered email notification. Learn more.

The watchlist is a list of users who are "watching" an incident; you can choose to notify all watchlist users (including technicians with a seat, the customer, and/or any groups that you have created) any time an incident is updated. Additionally, you can add external watchlist users (those not a technician or a customer) that you would like to update about an incident by adding their email address to the "external watchlist" section and clicking Save.

Service Desk provides a time-recording functionality that enables technicians to log the time spent working on records, as well as access visualizations of the work completed and generate reports. Time management can be accessed by selecting Service Desk > Time.

Time users and time administrators can log time spent working on a record under the Time section. They can also click View All to see the full time log history for the individual record.

Create incidents via the Customer Portal

Note: This feature must first be enabled by an account administrator.

Customers can submit incidents through the Customer Portal (if enabled by administrators). See Use the Customer Portal for more information.

Create incidents via email

Note: This feature must first be enabled by an account administrator.

If desired, administrators can allow incidents to be automatically created from emails received by a special support email address (this is enabled on a per-service basis). The support email address is a unique email address that is automatically created for each service by the Service Desk system ( "service-name] @ [customer portal URL]").

See Enable and Integrate a Service's Support Email Address for more information.

Create incidents from a template

Only service administrators can create and publish templates, but all agents on the account can access published templates and use them to generate new incidents, changes, or releases. Learn how to use templates.

Hide incident updates from customers

When customers submit incidents via the Customer Portal or agents link a customer to an incident, they are able to see the updates the incident continues to be tracked in the Customer Portal. This means that customers can view all updates and comments made to the incident, unless they are hidden from the customer by the agent.

To prevent customers from seeing comments and information meant only for agents, the following privacy features can be used when updating an incident.

  • Hide comments from customer – When creating a comment that should not be visible on the incident page in the Customer Portal, select the "Hide from customer" check box before clicking Save.

  • Disable "Show in Portal" setting – To prevent the incident from appearing at all within the portal, deselect the "Show in Portal" check box on the incident page. It will completely disappear from the My Incidents page in the Customer Portal.



Use Incidents and Incident Management

Import Multiple Incidents

Resolve and Close Incidents

Article last updated: 27 September, 2022