# Incident Triage

> Triage, prioritize, and assign incidents by impact, urgency, category, escalation risk, ownership, and SLA exposure.

- Skill: `happy-technologies-llc/incident-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add happy-technologies-llc/incident-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/happy-technologies-llc/incident-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Happy-Technologies-LLC (https://skillmd.com/u/happy-technologies-llc)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/happy-technologies-llc/incident-triage

---


# Incident Triage

## Overview

Use this skill to classify incoming incidents, validate priority, select an assignment group, and document the triage decision.

## Prerequisites

- Read and update access to incident records
- Read access to assignment groups
- Knowledge of the organization’s impact, urgency, and escalation rules

## Procedure

### Step 1: Identify Incidents Requiring Triage

Query for active incidents that are unassigned or in "New" state.

```
Tool: SN-Query-Table
Parameters:
  table_name: incident
  query: active=true^priorityIN1,2^assigned_toISEMPTY
  fields: number,short_description,description,impact,urgency,category,priority
  limit: 20
```

### Step 2: Analyze Each Incident

For each incident, determine:

1. **Category** — Match keywords to category:
   - Network: "network", "connectivity", "VPN", "wifi", "firewall"
   - Hardware: "laptop", "monitor", "keyboard", "printer", "device"
   - Software: "application", "crash", "error", "update"
   - Email: "email", "outlook", "mailbox", "calendar"
   - Security: "password", "access", "locked", "breach", "phishing"
   - SAP/ERP: "SAP", "ERP", "finance system", "procurement"

2. **Priority** — Apply the Impact/Urgency matrix:

   | Impact ↓ / Urgency → | High (1) | Medium (2) | Low (3) |
   |----------------------|----------|------------|---------|
   | High (1)             | P1       | P2         | P3      |
   | Medium (2)           | P2       | P3         | P4      |
   | Low (3)              | P3       | P4         | P5      |

3. **Escalation triggers** — Bump to P1 if any apply:
   - Executive mentioned or revenue impact
   - Security breach or phishing confirmed
   - Outage affecting multiple users
   - SLA at risk of breach

### Step 3: Resolve Assignment Group

Map the category to an assignment group:

| Category | Assignment Group |
|----------|------------------|
| Network | Network Operations |
| Hardware | Desktop Support |
| Software | Application Support |
| Email | Messaging Team |
| Security | Security Operations |
| SAP/ERP | ERP Support |
| Unknown | Service Desk L2 |

Look up the group sys_id:

```
Tool: SN-Query-Table
Parameters:
  table_name: sys_user_group
  query: name=Network Operations
  fields: sys_id,name
  limit: 1
```

**Validation checkpoint:** Confirm the query returns exactly one result with a valid `sys_id`. If no group is found, fall back to "Service Desk L2" and note the mismatch in work notes.

### Step 4: Assign the Incident

```
Tool: SN-Assign-Incident
Parameters:
  sys_id: [incident_sys_id]
  assignment_group: Network Operations
  work_notes: "Triage: Assigned to Network Operations based on keyword analysis (VPN connectivity issue). Priority validated as P2 per impact/urgency matrix."
```

**Validation checkpoint:** After assignment, query the incident to confirm `assignment_group` and `state` were updated. If the update failed (permissions, read-only state), log the error in work notes and flag for manual review.

### Step 5: Document Triage Decision

```
Tool: SN-Add-Work-Notes
Parameters:
  sys_id: [incident_sys_id]
  work_notes: "TRIAGE: Category=Network (VPN, connectivity). Impact=2 Urgency=1 → P2. Assigned Network Operations. Next: investigate VPN tunnel status."
```

## Troubleshooting

| Problem | Cause | Fix |
|---------|-------|-----|
| No incidents found | Query too restrictive | Broaden query; check different states |
| Assignment group not found | Name mismatch | Use LIKE operator: `nameLIKENetwork` |
| Insufficient permissions | Missing `itil` role or incident read-only | Verify roles; check incident state |

## Examples

### Network Issue Triage

Incident INC0012345 — "Cannot connect to VPN from home"

- Keywords: "VPN", "connect" → **Network**
- Impact: Medium (single user) / Urgency: High (cannot work) → **P2**
- Assignment: **Network Operations**

```
Tool: SN-Assign-Incident
Parameters:
  sys_id: abc123
  assignment_group: Network Operations
  work_notes: "Triage: VPN connectivity issue assigned to Network Ops. P2 priority."
```

### Security Escalation

Incident INC0012346 — "Suspicious email with attachment clicked"

- Keywords: "suspicious", "email", "clicked" → **Security** → **Escalate to P1**
- Assignment: **Security Operations** — notify security manager

```
Tool: SN-Update-Record
Parameters:
  sys_id: def456
  table_name: incident
  fields: { priority: 1, assignment_group: Security Operations, work_notes: "Triage: Escalated to P1. Phishing indicator. Security Ops notified." }
```
## Best Practices

- Verify impact and urgency independently before accepting the calculated priority.
- Confirm the assignment group exists before updating the incident.
- Record the evidence and reasoning behind every triage decision.