# Quick Reference

> ITSM quick reference card with common operations, state values, priority matrix, and encoded query examples

- Skill: `happy-technologies-llc/quick-reference` (Agent Skill)
- Install (CLI): `npx skillmds@latest add happy-technologies-llc/quick-reference`
- Raw SKILL.md: https://api.skillmd.com/api/skills/happy-technologies-llc/quick-reference/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Happy-Technologies-LLC (https://skillmd.com/u/happy-technologies-llc)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/happy-technologies-llc/quick-reference

---


# ITSM Quick Reference

## Overview

A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.

- **What problem does it solve?** Quick lookup for common ITSM values and operations
- **Who should use this skill?** Anyone working with incidents, changes, or problems
- **What are the expected outcomes?** Faster development with fewer documentation lookups

## Prerequisites

- Appropriate roles and table access for the operation being performed
- A confirmed target instance before making changes

## Procedure

### Incident Operations

### Quick Actions

| Action | MCP Tool | Key Parameters |
|--------|----------|----------------|
| List incidents | `SN-List-Incidents` | `query`, `limit` |
| Create incident | `SN-Create-Incident` | `short_description`, `caller_id`, `category` |
| Update incident | `SN-Update-Record` | `table_name: incident`, `sys_id`, `data` |
| Get incident | `SN-Get-Incident` | `sys_id` |
| Close incident | `SN-Close-Incident` | `sys_id`, `resolution_code`, `resolution_notes` |
| Assign incident | `SN-Assign-Incident` | `sys_id`, `assigned_to`, `assignment_group` |
| Add work notes | `SN-Add-Work-Notes` | `sys_id`, `work_notes` |
| Search incidents | `SN-Natural-Language-Search` | `table: incident`, natural language query |

### Create Incident

```
Tool: SN-Create-Incident
Parameters:
  short_description: Unable to access email
  description: User reports Outlook not connecting to server
  caller_id: <user_sys_id>
  category: software
  subcategory: email
  impact: 3
  urgency: 3
```

### Close Incident

```
Tool: SN-Close-Incident
Parameters:
  sys_id: <incident_sys_id>
  resolution_code: Solved (Permanently)
  resolution_notes: Restarted email service and cleared user cache
  close_notes: User confirmed email is working
```

### Assign Incident

```
Tool: SN-Assign-Incident
Parameters:
  sys_id: <incident_sys_id>
  assigned_to: <user_sys_id>
  assignment_group: <group_sys_id>
```

## State Values

### Incident States

| Value | Label | Description |
|-------|-------|-------------|
| 1 | New | Newly created, not yet triaged |
| 2 | In Progress | Work has started |
| 3 | On Hold | Waiting for external input |
| 6 | Resolved | Solution implemented, pending verification |
| 7 | Closed | Verified and closed |
| 8 | Canceled | Canceled (not applicable) |

### Change Request States

| Value | Label | Description |
|-------|-------|-------------|
| -5 | New | Draft state |
| -4 | Assess | Assessment phase |
| -3 | Authorize | Awaiting authorization |
| -2 | Scheduled | Approved and scheduled |
| -1 | Implement | Implementation in progress |
| 0 | Review | Post-implementation review |
| 3 | Closed | Successfully completed |
| 4 | Canceled | Change canceled |

### Problem States

| Value | Label | Description |
|-------|-------|-------------|
| 1 | New | Newly identified |
| 2 | Assess | Under assessment |
| 3 | Root Cause Analysis | Investigating root cause |
| 4 | Fix in Progress | Working on permanent fix |
| 5 | Resolved | Root cause addressed |
| 6 | Closed | Verified and closed |
| 7 | Canceled | Problem canceled |

### Change Types

| Value | Label | Description |
|-------|-------|-------------|
| standard | Standard | Pre-approved, low risk |
| normal | Normal | Requires CAB approval |
| emergency | Emergency | Expedited approval process |

## Priority Matrix

### Impact x Urgency = Priority

|           | Urgency 1 (High) | Urgency 2 (Medium) | Urgency 3 (Low) |
|-----------|------------------|---------------------|------------------|
| **Impact 1 (High)** | Priority 1 (Critical) | Priority 2 (High) | Priority 3 (Moderate) |
| **Impact 2 (Medium)** | Priority 2 (High) | Priority 3 (Moderate) | Priority 4 (Low) |
| **Impact 3 (Low)** | Priority 3 (Moderate) | Priority 4 (Low) | Priority 5 (Planning) |

### Priority Values

| Value | Label | SLA Target | Description |
|-------|-------|------------|-------------|
| 1 | Critical | 1 hour | Business critical, widespread impact |
| 2 | High | 4 hours | Significant business impact |
| 3 | Moderate | 24 hours | Limited business impact |
| 4 | Low | 72 hours | Minor inconvenience |
| 5 | Planning | No SLA | Future enhancement |

## Common Encoded Queries

### Incident Queries

| Description | Encoded Query |
|-------------|---------------|
| Active incidents | `active=true` |
| P1 incidents | `priority=1` |
| P1 or P2 incidents | `priority=1^ORpriority=2` |
| Unassigned incidents | `assigned_toISEMPTY` |
| Assigned incidents | `assigned_toISNOTEMPTY` |
| Created today | `sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday()` |
| Created last 7 days | `sys_created_on>=javascript:gs.daysAgoStart(7)` |
| New state | `state=1` |
| In Progress | `state=2` |
| Resolved or Closed | `state=6^ORstate=7` |
| Not Closed | `state!=7` |
| My incidents | `assigned_to=javascript:gs.getUserID()` |
| My team's incidents | `assignment_group=<group_sys_id>` |
| Contains text | `short_descriptionLIKEnetwork` |
| Starts with | `numberSTARTSWITHINC00100` |
| Category is network | `category=network` |
| Ordered by priority | `ORDERBYpriority` |
| Ordered by created (newest) | `ORDERBYDESCsys_created_on` |

### Change Request Queries

| Description | Encoded Query |
|-------------|---------------|
| Emergency changes | `type=emergency` |
| Normal changes | `type=normal` |
| Standard changes | `type=standard` |
| Scheduled changes | `state=-2` |
| Changes this week | `start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek()` |
| High risk changes | `risk=1` |
| Pending approval | `state=-3^approval!=approved` |

### Problem Queries

| Description | Encoded Query |
|-------------|---------------|
| Open problems | `state<6` |
| Root cause analysis | `state=3` |
| Known errors | `known_error=true` |
| Problems with workaround | `workaroundISNOTEMPTY` |
| Related to incidents | `related_incidentsISNOTEMPTY` |

## Field Reference

### Common Incident Fields

| Field | Type | Description |
|-------|------|-------------|
| `number` | String | Auto-generated (INC0010001) |
| `short_description` | String | Brief summary (required) |
| `description` | String | Detailed description |
| `caller_id` | Reference | Reporting user |
| `opened_by` | Reference | User who created record |
| `assigned_to` | Reference | Assigned technician |
| `assignment_group` | Reference | Assigned team |
| `state` | Choice | Current state |
| `impact` | Choice | Business impact (1-3) |
| `urgency` | Choice | Time sensitivity (1-3) |
| `priority` | Choice | Calculated priority (1-5) |
| `category` | Choice | Incident category |
| `subcategory` | Choice | Incident subcategory |
| `work_notes` | Journal | Internal notes |
| `comments` | Journal | Customer-visible notes |
| `resolution_code` | Choice | How resolved |
| `resolution_notes` | String | Resolution details |
| `close_code` | Choice | Closure reason |
| `close_notes` | String | Closure notes |
| `cmdb_ci` | Reference | Configuration item |

### Common Change Fields

| Field | Type | Description |
|-------|------|-------------|
| `number` | String | Auto-generated (CHG0010001) |
| `short_description` | String | Brief summary |
| `description` | String | Detailed description |
| `type` | Choice | standard/normal/emergency |
| `state` | Choice | Current state |
| `risk` | Choice | Risk level (1-4) |
| `impact` | Choice | Business impact (1-3) |
| `start_date` | DateTime | Planned start |
| `end_date` | DateTime | Planned end |
| `requested_by` | Reference | Requester |
| `assigned_to` | Reference | Change owner |
| `assignment_group` | Reference | Owning team |
| `cab_required` | Boolean | Needs CAB approval |
| `justification` | String | Business justification |
| `implementation_plan` | String | Implementation steps |
| `backout_plan` | String | Rollback procedure |
| `test_plan` | String | Testing steps |

### Common Problem Fields

| Field | Type | Description |
|-------|------|-------------|
| `number` | String | Auto-generated (PRB0010001) |
| `short_description` | String | Brief summary |
| `description` | String | Detailed description |
| `state` | Choice | Current state |
| `priority` | Choice | Priority (1-5) |
| `assigned_to` | Reference | Problem manager |
| `assignment_group` | Reference | Owning team |
| `known_error` | Boolean | Is known error |
| `workaround` | String | Temporary workaround |
| `cause_notes` | String | Root cause |
| `fix_notes` | String | Permanent fix |
| `related_incidents` | List | Related incidents |
| `cmdb_ci` | Reference | Configuration item |

## Resolution Codes

### Incident Resolution Codes

| Value | Label |
|-------|-------|
| Solved (Work Around) | Temporary fix applied |
| Solved (Permanently) | Root cause addressed |
| Solved Remotely (Work Around) | Remote temporary fix |
| Solved Remotely (Permanently) | Remote permanent fix |
| Not Solved (Not Reproducible) | Cannot reproduce |
| Not Solved (Too Costly) | Fix not cost-effective |
| Closed/Resolved by Caller | User resolved |

### Close Codes

| Value | Label |
|-------|-------|
| Solved | Resolved successfully |
| Closed/Resolved by Caller | User resolved |
| Not Solved (Not Reproducible) | Cannot reproduce |
| Closed (Cancelled) | Request withdrawn |

## Category Reference

### Incident Categories

| Category | Subcategories |
|----------|---------------|
| `hardware` | cpu, disk, keyboard, memory, monitor, mouse |
| `software` | email, operating system, application |
| `network` | connectivity, dhcp, dns, firewall, vpn |
| `database` | db2, ms sql server, oracle |
| `inquiry` | request, password reset |

## MCP Tools Quick Reference

### Incident Tools

| Tool | Purpose | Required Parameters |
|------|---------|---------------------|
| `SN-List-Incidents` | Query incidents | - |
| `SN-Get-Incident` | Get single incident | `sys_id` |
| `SN-Create-Incident` | Create incident | `short_description` |
| `SN-Update-Record` | Update incident | `table_name`, `sys_id`, `data` |
| `SN-Close-Incident` | Close incident | `sys_id`, `resolution_code` |
| `SN-Assign-Incident` | Assign incident | `sys_id` |
| `SN-Add-Work-Notes` | Add work notes | `sys_id`, `work_notes` |
| `SN-Natural-Language-Search` | NL search | `table`, `query` |

### Generic Tools

| Tool | Purpose | Required Parameters |
|------|---------|---------------------|
| `SN-Query-Table` | Query any table | `table_name` |
| `SN-Get-Record` | Get any record | `table_name`, `sys_id` |
| `SN-Create-Record` | Create any record | `table_name`, `data` |
| `SN-Update-Record` | Update any record | `table_name`, `sys_id`, `data` |

## Common Workflows

### Triage New Incident

```
1. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)
2. Review: Check short_description, category, caller_id
3. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)
4. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)
5. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)
```

### Escalate Incident

```
1. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)
2. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)
3. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)
```

### Resolve Incident

```
1. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)
2. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)
```

### Close Incident

```
1. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)
```

## REST API Endpoints

### Table API

| Table | Endpoint |
|-------|----------|
| Incident | `/api/now/table/incident` |
| Change Request | `/api/now/table/change_request` |
| Problem | `/api/now/table/problem` |
| Task | `/api/now/table/task` |
| User | `/api/now/table/sys_user` |
| Group | `/api/now/table/sys_user_group` |
| CI | `/api/now/table/cmdb_ci` |

### Common Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `sysparm_query` | Encoded query | `active=true^priority=1` |
| `sysparm_fields` | Fields to return | `number,short_description,state` |
| `sysparm_limit` | Max records | `100` |
| `sysparm_offset` | Skip records | `50` |
| `sysparm_display_value` | Display values | `all`, `true`, `false` |

## Best Practices

- Query and verify records before updating them.
- Prefer the narrowest table, field list, and encoded query that satisfies the task.
- Confirm state and resolution values against the target instance before closing records.

## Related Skills

- `itsm/incident-lifecycle` - Full incident lifecycle management
- `itsm/incident-triage` - Detailed triage procedures
- `itsm/natural-language-queries` - Natural language search
- `admin/generic-crud-operations` - Detailed CRUD operations

## References

- [ServiceNow ITSM Documentation](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentManagement.html)
- [Incident State Flow](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentStateFlow.html)
- [Change Management](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/change-management/concept/c_ITILChangeManagement.html)