Incident Diagnosis & Investigation

From Hornbill
Jump to navigation Jump to search

Home > Service Manager > Incident Diagnosis & Investigation


Service Manager is a highly configurable, flexible solution which is not prescriptive in how you manage your Incident Process. Incident Management processes can be automated, or entirely manual depending on your requirements.

Incident Categorization & Prioritization

It is possible to allow both analysts and supported customers to categorise their Incidents during either the Incident Logging process (by exposing the Request Category form in Progressive Capture), or allowing the analyst to categorize once the Incident has been logged. The category can be used to influence the Incident diagnosis process by routing the Incident to the most relevant resolver team, routing rules can be configured in the Business Process Tool to support your Incident process.

The priority of the Incident can be manually set during logging of the Incident by an analyst using Progressive Capture, this can set as a mandatory option if required. Alternatively once the resolver team working on the diagnosis of the Incident, open the Incident form the Priority of the Incident can be set as a required action by the supporting Incident Process (Suspend Await Priority). Priority is used to determine how quickly an Incident should be addressed and can be used to determine Service Level Targets for each Incident.

Diagnosis & Investigation

Resolver teams can conduct the diagnosis of the Incident by reviewing the Incident information supplied, verifying the information with the customer via phone, email or self service and then can begin the process of returning the user to a business as usual position as quickly as possible.

Incident diagnosis can be entirely manual, or can follow an Incident business process which can manage the creation of tasks for analysts, or defined roles for the investigation these can automatically be invoked based on the type of Incident reported (differing for example if it was a Desktop Support Issue, compared to a VPN connection issue).

Analysts can update the Incident timeline with all diagnosis investigation. Different Update actions are available from the 'Action Bar' on the Incident form.

Action Bar.png

Update Actions

  • Update - Text can be entered, images can be cut and pasted into the update box, or links can be shared (YouTube, Prezzi etc) all images and links to supported media can be viewed and where appropriated watched inline.
  • Callback - Callbacks can be scheduled for a date and time in the future, with supporting notes. Defining a Callback will create a new activity which will be associated to the Incident, against which reminders and checklists for Callback can be set. It is also possible to use the Callback option to add notes from the callback conversation and have those notes added to the Incident timeline as a Phone update. Updates can filtered by update type so it is useful to accurately record all communication.
  • Attach - It is possible to drag and drop or search for attachments to add to the Incident, once one or multiple attachments have been added a new 'Attachments' section will be exposed on the Incident form containing the attachments, time and date they where attached, size of the attachment and any accompanying description for each attachment.
  • Link - It is possible to search for and link other related Incidents, or other Request types to an Incident. It is also possible from the Link option to raise a Linked Problem, Change or other Request Types (rights permitting)
  • Email - It is is possible to email directly out to the Incident form to the Customer or other interested parties
  • Change Customer - if the Incident has been logged against the incorrect Customer
  • Assign - Assign the Incident to another analyst or resolver team
  • Assets - Add or remove Assets from the Incident
  • Boards - Add the Incident manually onto an appropriate visual Board

For each update that is being applied, you can choose the visibility level for the update. Marking the update as 'Customer' will allow the customer to view the update view the appropriate self service portal, marking the update as 'team' will keep the update private to the Team working on the Incident.


  • Other Action types are available and will be covered in the escalation and resolution sections of Incident Management.
  • The Update Actions visible on an Incident form can differ depending on your rights to update an Incident, and or based on the Actions defined (enabled) for Incidents logged against specific Services you provide.


As well as traditional options to support assigning the Incident to another resolver team or analyst to aid the diagnosis and investigation, it is also possible to add subject matter experts into the process by adding them as members to an Incident (and other Request Types).

Adding members can allow other analysts who may not normally have the appropriate rights to view an Incident which sits with your team or the Services you support to have their rights elevated for specific Incidents allowing them to collaborate and assist with the investigation.

Members can be added by selecting the + option from the Members box on the Incident form. Members will be notified that they have been added to the Incident by receiving a Hornbill notification.

Add Member.png

An analyst adding a Member to the Incident can also Mention the Member in an update, potentially defining what assistance they need from the Member on the Incident. The Member will receive a notification relating to the mention.

Mention update.png