ITSM Quick Reference
Overview
A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.
- What problem does it solve? Quick lookup for common ITSM values and operations
- Who should use this skill? Anyone working with incidents, changes, or problems
- What are the expected outcomes? Faster development with fewer documentation lookups
Prerequisites
- Appropriate roles and table access for the operation being performed
- A confirmed target instance before making changes
Procedure
Incident Operations
Quick Actions
| Action |
MCP Tool |
Key Parameters |
| List incidents |
SN-List-Incidents |
query, limit |
| Create incident |
SN-Create-Incident |
short_description, caller_id, category |
| Update incident |
SN-Update-Record |
table_name: incident, sys_id, data |
| Get incident |
SN-Get-Incident |
sys_id |
| Close incident |
SN-Close-Incident |
sys_id, resolution_code, resolution_notes |
| Assign incident |
SN-Assign-Incident |
sys_id, assigned_to, assignment_group |
| Add work notes |
SN-Add-Work-Notes |
sys_id, work_notes |
| Search incidents |
SN-Natural-Language-Search |
table: incident, natural language query |
Create Incident
Tool: SN-Create-Incident
Parameters:
short_description: Unable to access email
description: User reports Outlook not connecting to server
caller_id: <user_sys_id>
category: software
subcategory: email
impact: 3
urgency: 3
Close Incident
Tool: SN-Close-Incident
Parameters:
sys_id: <incident_sys_id>
resolution_code: Solved (Permanently)
resolution_notes: Restarted email service and cleared user cache
close_notes: User confirmed email is working
Assign Incident
Tool: SN-Assign-Incident
Parameters:
sys_id: <incident_sys_id>
assigned_to: <user_sys_id>
assignment_group: <group_sys_id>
State Values
Incident States
| Value |
Label |
Description |
| 1 |
New |
Newly created, not yet triaged |
| 2 |
In Progress |
Work has started |
| 3 |
On Hold |
Waiting for external input |
| 6 |
Resolved |
Solution implemented, pending verification |
| 7 |
Closed |
Verified and closed |
| 8 |
Canceled |
Canceled (not applicable) |
Change Request States
| Value |
Label |
Description |
| -5 |
New |
Draft state |
| -4 |
Assess |
Assessment phase |
| -3 |
Authorize |
Awaiting authorization |
| -2 |
Scheduled |
Approved and scheduled |
| -1 |
Implement |
Implementation in progress |
| 0 |
Review |
Post-implementation review |
| 3 |
Closed |
Successfully completed |
| 4 |
Canceled |
Change canceled |
Problem States
| Value |
Label |
Description |
| 1 |
New |
Newly identified |
| 2 |
Assess |
Under assessment |
| 3 |
Root Cause Analysis |
Investigating root cause |
| 4 |
Fix in Progress |
Working on permanent fix |
| 5 |
Resolved |
Root cause addressed |
| 6 |
Closed |
Verified and closed |
| 7 |
Canceled |
Problem canceled |
Change Types
| Value |
Label |
Description |
| standard |
Standard |
Pre-approved, low risk |
| normal |
Normal |
Requires CAB approval |
| emergency |
Emergency |
Expedited approval process |
Priority Matrix
Impact x Urgency = Priority
|
Urgency 1 (High) |
Urgency 2 (Medium) |
Urgency 3 (Low) |
| Impact 1 (High) |
Priority 1 (Critical) |
Priority 2 (High) |
Priority 3 (Moderate) |
| Impact 2 (Medium) |
Priority 2 (High) |
Priority 3 (Moderate) |
Priority 4 (Low) |
| Impact 3 (Low) |
Priority 3 (Moderate) |
Priority 4 (Low) |
Priority 5 (Planning) |
Priority Values
| Value |
Label |
SLA Target |
Description |
| 1 |
Critical |
1 hour |
Business critical, widespread impact |
| 2 |
High |
4 hours |
Significant business impact |
| 3 |
Moderate |
24 hours |
Limited business impact |
| 4 |
Low |
72 hours |
Minor inconvenience |
| 5 |
Planning |
No SLA |
Future enhancement |
Common Encoded Queries
Incident Queries
| Description |
Encoded Query |
| Active incidents |
active=true |
| P1 incidents |
priority=1 |
| P1 or P2 incidents |
priority=1^ORpriority=2 |
| Unassigned incidents |
assigned_toISEMPTY |
| Assigned incidents |
assigned_toISNOTEMPTY |
| Created today |
sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday() |
| Created last 7 days |
sys_created_on>=javascript:gs.daysAgoStart(7) |
| New state |
state=1 |
| In Progress |
state=2 |
| Resolved or Closed |
state=6^ORstate=7 |
| Not Closed |
state!=7 |
| My incidents |
assigned_to=javascript:gs.getUserID() |
| My team's incidents |
assignment_group=<group_sys_id> |
| Contains text |
short_descriptionLIKEnetwork |
| Starts with |
numberSTARTSWITHINC00100 |
| Category is network |
category=network |
| Ordered by priority |
ORDERBYpriority |
| Ordered by created (newest) |
ORDERBYDESCsys_created_on |
Change Request Queries
| Description |
Encoded Query |
| Emergency changes |
type=emergency |
| Normal changes |
type=normal |
| Standard changes |
type=standard |
| Scheduled changes |
state=-2 |
| Changes this week |
start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek() |
| High risk changes |
risk=1 |
| Pending approval |
state=-3^approval!=approved |
Problem Queries
| Description |
Encoded Query |
| Open problems |
state<6 |
| Root cause analysis |
state=3 |
| Known errors |
known_error=true |
| Problems with workaround |
workaroundISNOTEMPTY |
| Related to incidents |
related_incidentsISNOTEMPTY |
Field Reference
Common Incident Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (INC0010001) |
short_description |
String |
Brief summary (required) |
description |
String |
Detailed description |
caller_id |
Reference |
Reporting user |
opened_by |
Reference |
User who created record |
assigned_to |
Reference |
Assigned technician |
assignment_group |
Reference |
Assigned team |
state |
Choice |
Current state |
impact |
Choice |
Business impact (1-3) |
urgency |
Choice |
Time sensitivity (1-3) |
priority |
Choice |
Calculated priority (1-5) |
category |
Choice |
Incident category |
subcategory |
Choice |
Incident subcategory |
work_notes |
Journal |
Internal notes |
comments |
Journal |
Customer-visible notes |
resolution_code |
Choice |
How resolved |
resolution_notes |
String |
Resolution details |
close_code |
Choice |
Closure reason |
close_notes |
String |
Closure notes |
cmdb_ci |
Reference |
Configuration item |
Common Change Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (CHG0010001) |
short_description |
String |
Brief summary |
description |
String |
Detailed description |
type |
Choice |
standard/normal/emergency |
state |
Choice |
Current state |
risk |
Choice |
Risk level (1-4) |
impact |
Choice |
Business impact (1-3) |
start_date |
DateTime |
Planned start |
end_date |
DateTime |
Planned end |
requested_by |
Reference |
Requester |
assigned_to |
Reference |
Change owner |
assignment_group |
Reference |
Owning team |
cab_required |
Boolean |
Needs CAB approval |
justification |
String |
Business justification |
implementation_plan |
String |
Implementation steps |
backout_plan |
String |
Rollback procedure |
test_plan |
String |
Testing steps |
Common Problem Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (PRB0010001) |
short_description |
String |
Brief summary |
description |
String |
Detailed description |
state |
Choice |
Current state |
priority |
Choice |
Priority (1-5) |
assigned_to |
Reference |
Problem manager |
assignment_group |
Reference |
Owning team |
known_error |
Boolean |
Is known error |
workaround |
String |
Temporary workaround |
cause_notes |
String |
Root cause |
fix_notes |
String |
Permanent fix |
related_incidents |
List |
Related incidents |
cmdb_ci |
Reference |
Configuration item |
Resolution Codes
Incident Resolution Codes
| Value |
Label |
| Solved (Work Around) |
Temporary fix applied |
| Solved (Permanently) |
Root cause addressed |
| Solved Remotely (Work Around) |
Remote temporary fix |
| Solved Remotely (Permanently) |
Remote permanent fix |
| Not Solved (Not Reproducible) |
Cannot reproduce |
| Not Solved (Too Costly) |
Fix not cost-effective |
| Closed/Resolved by Caller |
User resolved |
Close Codes
| Value |
Label |
| Solved |
Resolved successfully |
| Closed/Resolved by Caller |
User resolved |
| Not Solved (Not Reproducible) |
Cannot reproduce |
| Closed (Cancelled) |
Request withdrawn |
Category Reference
Incident Categories
| Category |
Subcategories |
hardware |
cpu, disk, keyboard, memory, monitor, mouse |
software |
email, operating system, application |
network |
connectivity, dhcp, dns, firewall, vpn |
database |
db2, ms sql server, oracle |
inquiry |
request, password reset |
MCP Tools Quick Reference
Incident Tools
| Tool |
Purpose |
Required Parameters |
SN-List-Incidents |
Query incidents |
- |
SN-Get-Incident |
Get single incident |
sys_id |
SN-Create-Incident |
Create incident |
short_description |
SN-Update-Record |
Update incident |
table_name, sys_id, data |
SN-Close-Incident |
Close incident |
sys_id, resolution_code |
SN-Assign-Incident |
Assign incident |
sys_id |
SN-Add-Work-Notes |
Add work notes |
sys_id, work_notes |
SN-Natural-Language-Search |
NL search |
table, query |
Generic Tools
| Tool |
Purpose |
Required Parameters |
SN-Query-Table |
Query any table |
table_name |
SN-Get-Record |
Get any record |
table_name, sys_id |
SN-Create-Record |
Create any record |
table_name, data |
SN-Update-Record |
Update any record |
table_name, sys_id, data |
Common Workflows
Triage New Incident
1. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)
2. Review: Check short_description, category, caller_id
3. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)
4. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)
5. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)
Escalate Incident
1. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)
2. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)
3. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)
Resolve Incident
1. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)
2. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)
Close Incident
1. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)
REST API Endpoints
Table API
| Table |
Endpoint |
| Incident |
/api/now/table/incident |
| Change Request |
/api/now/table/change_request |
| Problem |
/api/now/table/problem |
| Task |
/api/now/table/task |
| User |
/api/now/table/sys_user |
| Group |
/api/now/table/sys_user_group |
| CI |
/api/now/table/cmdb_ci |
Common Parameters
| Parameter |
Description |
Example |
sysparm_query |
Encoded query |
active=true^priority=1 |
sysparm_fields |
Fields to return |
number,short_description,state |
sysparm_limit |
Max records |
100 |
sysparm_offset |
Skip records |
50 |
sysparm_display_value |
Display values |
all, true, false |
Best Practices
- Query and verify records before updating them.
- Prefer the narrowest table, field list, and encoded query that satisfies the task.
- Confirm state and resolution values against the target instance before closing records.
Related Skills
itsm/incident-lifecycle - Full incident lifecycle managementitsm/incident-triage - Detailed triage proceduresitsm/natural-language-queries - Natural language searchadmin/generic-crud-operations - Detailed CRUD operations
References
1---2name: quick-reference3version: 1.0.24description: ITSM quick reference card with common operations, state values, priority matrix, and encoded query examples5author: Happy Technologies LLC6tags: [itsm, reference, cheatsheet, quick-start]7platforms: [claude-code, claude-desktop, chatgpt, cursor, any]8tools:9 mcp: [SN-Query-Table, SN-Create-Record, SN-Update-Record, SN-Get-Record, SN-List-Incidents, SN-Create-Incident, SN-Resolve-Incident, SN-Close-Incident, SN-Assign-Incident, SN-Add-Work-Notes, SN-Natural-Language-Search, SN-List-ChangeRequests, SN-List-Problems]10 rest: [/api/now/table/incident, /api/now/table/change_request, /api/now/table/problem]11complexity: beginner12estimated_time: 5 minutes13---1415# ITSM Quick Reference1617## Overview1819A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.2021- **What problem does it solve?** Quick lookup for common ITSM values and operations22- **Who should use this skill?** Anyone working with incidents, changes, or problems23- **What are the expected outcomes?** Faster development with fewer documentation lookups2425## Prerequisites2627- Appropriate roles and table access for the operation being performed28- A confirmed target instance before making changes2930## Procedure3132### Incident Operations3334### Quick Actions3536| Action | MCP Tool | Key Parameters |37|--------|----------|----------------|38| List incidents | `SN-List-Incidents` | `query`, `limit` |39| Create incident | `SN-Create-Incident` | `short_description`, `caller_id`, `category` |40| Update incident | `SN-Update-Record` | `table_name: incident`, `sys_id`, `data` |41| Get incident | `SN-Get-Incident` | `sys_id` |42| Close incident | `SN-Close-Incident` | `sys_id`, `resolution_code`, `resolution_notes` |43| Assign incident | `SN-Assign-Incident` | `sys_id`, `assigned_to`, `assignment_group` |44| Add work notes | `SN-Add-Work-Notes` | `sys_id`, `work_notes` |45| Search incidents | `SN-Natural-Language-Search` | `table: incident`, natural language query |4647### Create Incident4849```50Tool: SN-Create-Incident51Parameters:52 short_description: Unable to access email53 description: User reports Outlook not connecting to server54 caller_id: <user_sys_id>55 category: software56 subcategory: email57 impact: 358 urgency: 359```6061### Close Incident6263```64Tool: SN-Close-Incident65Parameters:66 sys_id: <incident_sys_id>67 resolution_code: Solved (Permanently)68 resolution_notes: Restarted email service and cleared user cache69 close_notes: User confirmed email is working70```7172### Assign Incident7374```75Tool: SN-Assign-Incident76Parameters:77 sys_id: <incident_sys_id>78 assigned_to: <user_sys_id>79 assignment_group: <group_sys_id>80```8182## State Values8384### Incident States8586| Value | Label | Description |87|-------|-------|-------------|88| 1 | New | Newly created, not yet triaged |89| 2 | In Progress | Work has started |90| 3 | On Hold | Waiting for external input |91| 6 | Resolved | Solution implemented, pending verification |92| 7 | Closed | Verified and closed |93| 8 | Canceled | Canceled (not applicable) |9495### Change Request States9697| Value | Label | Description |98|-------|-------|-------------|99| -5 | New | Draft state |100| -4 | Assess | Assessment phase |101| -3 | Authorize | Awaiting authorization |102| -2 | Scheduled | Approved and scheduled |103| -1 | Implement | Implementation in progress |104| 0 | Review | Post-implementation review |105| 3 | Closed | Successfully completed |106| 4 | Canceled | Change canceled |107108### Problem States109110| Value | Label | Description |111|-------|-------|-------------|112| 1 | New | Newly identified |113| 2 | Assess | Under assessment |114| 3 | Root Cause Analysis | Investigating root cause |115| 4 | Fix in Progress | Working on permanent fix |116| 5 | Resolved | Root cause addressed |117| 6 | Closed | Verified and closed |118| 7 | Canceled | Problem canceled |119120### Change Types121122| Value | Label | Description |123|-------|-------|-------------|124| standard | Standard | Pre-approved, low risk |125| normal | Normal | Requires CAB approval |126| emergency | Emergency | Expedited approval process |127128## Priority Matrix129130### Impact x Urgency = Priority131132| | Urgency 1 (High) | Urgency 2 (Medium) | Urgency 3 (Low) |133|-----------|------------------|---------------------|------------------|134| **Impact 1 (High)** | Priority 1 (Critical) | Priority 2 (High) | Priority 3 (Moderate) |135| **Impact 2 (Medium)** | Priority 2 (High) | Priority 3 (Moderate) | Priority 4 (Low) |136| **Impact 3 (Low)** | Priority 3 (Moderate) | Priority 4 (Low) | Priority 5 (Planning) |137138### Priority Values139140| Value | Label | SLA Target | Description |141|-------|-------|------------|-------------|142| 1 | Critical | 1 hour | Business critical, widespread impact |143| 2 | High | 4 hours | Significant business impact |144| 3 | Moderate | 24 hours | Limited business impact |145| 4 | Low | 72 hours | Minor inconvenience |146| 5 | Planning | No SLA | Future enhancement |147148## Common Encoded Queries149150### Incident Queries151152| Description | Encoded Query |153|-------------|---------------|154| Active incidents | `active=true` |155| P1 incidents | `priority=1` |156| P1 or P2 incidents | `priority=1^ORpriority=2` |157| Unassigned incidents | `assigned_toISEMPTY` |158| Assigned incidents | `assigned_toISNOTEMPTY` |159| Created today | `sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday()` |160| Created last 7 days | `sys_created_on>=javascript:gs.daysAgoStart(7)` |161| New state | `state=1` |162| In Progress | `state=2` |163| Resolved or Closed | `state=6^ORstate=7` |164| Not Closed | `state!=7` |165| My incidents | `assigned_to=javascript:gs.getUserID()` |166| My team's incidents | `assignment_group=<group_sys_id>` |167| Contains text | `short_descriptionLIKEnetwork` |168| Starts with | `numberSTARTSWITHINC00100` |169| Category is network | `category=network` |170| Ordered by priority | `ORDERBYpriority` |171| Ordered by created (newest) | `ORDERBYDESCsys_created_on` |172173### Change Request Queries174175| Description | Encoded Query |176|-------------|---------------|177| Emergency changes | `type=emergency` |178| Normal changes | `type=normal` |179| Standard changes | `type=standard` |180| Scheduled changes | `state=-2` |181| Changes this week | `start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek()` |182| High risk changes | `risk=1` |183| Pending approval | `state=-3^approval!=approved` |184185### Problem Queries186187| Description | Encoded Query |188|-------------|---------------|189| Open problems | `state<6` |190| Root cause analysis | `state=3` |191| Known errors | `known_error=true` |192| Problems with workaround | `workaroundISNOTEMPTY` |193| Related to incidents | `related_incidentsISNOTEMPTY` |194195## Field Reference196197### Common Incident Fields198199| Field | Type | Description |200|-------|------|-------------|201| `number` | String | Auto-generated (INC0010001) |202| `short_description` | String | Brief summary (required) |203| `description` | String | Detailed description |204| `caller_id` | Reference | Reporting user |205| `opened_by` | Reference | User who created record |206| `assigned_to` | Reference | Assigned technician |207| `assignment_group` | Reference | Assigned team |208| `state` | Choice | Current state |209| `impact` | Choice | Business impact (1-3) |210| `urgency` | Choice | Time sensitivity (1-3) |211| `priority` | Choice | Calculated priority (1-5) |212| `category` | Choice | Incident category |213| `subcategory` | Choice | Incident subcategory |214| `work_notes` | Journal | Internal notes |215| `comments` | Journal | Customer-visible notes |216| `resolution_code` | Choice | How resolved |217| `resolution_notes` | String | Resolution details |218| `close_code` | Choice | Closure reason |219| `close_notes` | String | Closure notes |220| `cmdb_ci` | Reference | Configuration item |221222### Common Change Fields223224| Field | Type | Description |225|-------|------|-------------|226| `number` | String | Auto-generated (CHG0010001) |227| `short_description` | String | Brief summary |228| `description` | String | Detailed description |229| `type` | Choice | standard/normal/emergency |230| `state` | Choice | Current state |231| `risk` | Choice | Risk level (1-4) |232| `impact` | Choice | Business impact (1-3) |233| `start_date` | DateTime | Planned start |234| `end_date` | DateTime | Planned end |235| `requested_by` | Reference | Requester |236| `assigned_to` | Reference | Change owner |237| `assignment_group` | Reference | Owning team |238| `cab_required` | Boolean | Needs CAB approval |239| `justification` | String | Business justification |240| `implementation_plan` | String | Implementation steps |241| `backout_plan` | String | Rollback procedure |242| `test_plan` | String | Testing steps |243244### Common Problem Fields245246| Field | Type | Description |247|-------|------|-------------|248| `number` | String | Auto-generated (PRB0010001) |249| `short_description` | String | Brief summary |250| `description` | String | Detailed description |251| `state` | Choice | Current state |252| `priority` | Choice | Priority (1-5) |253| `assigned_to` | Reference | Problem manager |254| `assignment_group` | Reference | Owning team |255| `known_error` | Boolean | Is known error |256| `workaround` | String | Temporary workaround |257| `cause_notes` | String | Root cause |258| `fix_notes` | String | Permanent fix |259| `related_incidents` | List | Related incidents |260| `cmdb_ci` | Reference | Configuration item |261262## Resolution Codes263264### Incident Resolution Codes265266| Value | Label |267|-------|-------|268| Solved (Work Around) | Temporary fix applied |269| Solved (Permanently) | Root cause addressed |270| Solved Remotely (Work Around) | Remote temporary fix |271| Solved Remotely (Permanently) | Remote permanent fix |272| Not Solved (Not Reproducible) | Cannot reproduce |273| Not Solved (Too Costly) | Fix not cost-effective |274| Closed/Resolved by Caller | User resolved |275276### Close Codes277278| Value | Label |279|-------|-------|280| Solved | Resolved successfully |281| Closed/Resolved by Caller | User resolved |282| Not Solved (Not Reproducible) | Cannot reproduce |283| Closed (Cancelled) | Request withdrawn |284285## Category Reference286287### Incident Categories288289| Category | Subcategories |290|----------|---------------|291| `hardware` | cpu, disk, keyboard, memory, monitor, mouse |292| `software` | email, operating system, application |293| `network` | connectivity, dhcp, dns, firewall, vpn |294| `database` | db2, ms sql server, oracle |295| `inquiry` | request, password reset |296297## MCP Tools Quick Reference298299### Incident Tools300301| Tool | Purpose | Required Parameters |302|------|---------|---------------------|303| `SN-List-Incidents` | Query incidents | - |304| `SN-Get-Incident` | Get single incident | `sys_id` |305| `SN-Create-Incident` | Create incident | `short_description` |306| `SN-Update-Record` | Update incident | `table_name`, `sys_id`, `data` |307| `SN-Close-Incident` | Close incident | `sys_id`, `resolution_code` |308| `SN-Assign-Incident` | Assign incident | `sys_id` |309| `SN-Add-Work-Notes` | Add work notes | `sys_id`, `work_notes` |310| `SN-Natural-Language-Search` | NL search | `table`, `query` |311312### Generic Tools313314| Tool | Purpose | Required Parameters |315|------|---------|---------------------|316| `SN-Query-Table` | Query any table | `table_name` |317| `SN-Get-Record` | Get any record | `table_name`, `sys_id` |318| `SN-Create-Record` | Create any record | `table_name`, `data` |319| `SN-Update-Record` | Update any record | `table_name`, `sys_id`, `data` |320321## Common Workflows322323### Triage New Incident324325```3261. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)3272. Review: Check short_description, category, caller_id3283. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)3294. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)3305. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)331```332333### Escalate Incident334335```3361. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)3372. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)3383. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)339```340341### Resolve Incident342343```3441. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)3452. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)346```347348### Close Incident349350```3511. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)352```353354## REST API Endpoints355356### Table API357358| Table | Endpoint |359|-------|----------|360| Incident | `/api/now/table/incident` |361| Change Request | `/api/now/table/change_request` |362| Problem | `/api/now/table/problem` |363| Task | `/api/now/table/task` |364| User | `/api/now/table/sys_user` |365| Group | `/api/now/table/sys_user_group` |366| CI | `/api/now/table/cmdb_ci` |367368### Common Parameters369370| Parameter | Description | Example |371|-----------|-------------|---------|372| `sysparm_query` | Encoded query | `active=true^priority=1` |373| `sysparm_fields` | Fields to return | `number,short_description,state` |374| `sysparm_limit` | Max records | `100` |375| `sysparm_offset` | Skip records | `50` |376| `sysparm_display_value` | Display values | `all`, `true`, `false` |377378## Best Practices379380- Query and verify records before updating them.381- Prefer the narrowest table, field list, and encoded query that satisfies the task.382- Confirm state and resolution values against the target instance before closing records.383384## Related Skills385386- `itsm/incident-lifecycle` - Full incident lifecycle management387- `itsm/incident-triage` - Detailed triage procedures388- `itsm/natural-language-queries` - Natural language search389- `admin/generic-crud-operations` - Detailed CRUD operations390391## References392393- [ServiceNow ITSM Documentation](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentManagement.html)394- [Incident State Flow](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentStateFlow.html)395- [Change Management](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/change-management/concept/c_ITILChangeManagement.html)
Happy-Technologies-LLC