2. Incident Classification and Initial Support

Incident classification includes setting priority, performing incident matching, and linking incidents to configuration items. Initial support includes finding an existing workaround or matching other existing errors.

In the Classification state, the Service Desk staff reviews the issue and determines how the incident should be handled. The following actions may be available to you for updating and routing the incident, depending on your role:

Assign the incident, which automatically routes the item based on the answer to Major Incident.
- If item is not a major incident, the issue is either assigned to the Level 1 Technician for additional review, or to a group queue where the issue remains until a member of the group takes ownership of it. It can also be assigned to both a technician and a group queue, which provides a backup if the technician cannot complete the work in a timely manner. (For information about group queues, see Group Queues.)
  Note: The Level 1 Technician list includes users who are in the Level 1 Tech, Level 2 Tech, and Level 3 Tech roles. This allows a Level 2 Tech or Level 3 Tech to be assigned level 1 incidents if the technician is available.
- If item is a major incident, the incident is immediately escalated to the incident manager.
  Note: Major incidents require the immediate attention of the incident manager. The incident manager may pull in the appropriate resources to quickly restore normal service operations. It may also require the incident manager to coordinate with problem management to find the root cause of the major incident to prevent its recurrence.
Resolve the incident, noting whether it was resolved on the first call.
Update with additional information from the user.

The following options are available under the More Actions menu. They allow you to delete an incident, move the incident to another project, merge the incident with other incidents, or create duplicate incidents.

Remove Problem Link removes a problem link from the incident. The problem is not deleted, only the relationship between the incident and the problem.
Copy Incident creates a duplicate of the incident in the same state as the current incident. You cannot modify the values when the item is created.
Merge Incident ties the current incident to another existing incident using Parent/Child relationships. See Merging or Linking Incidents.
Post New Incident creates another incident based on the current incident. You can modify the values in the new incident on the Submit form; the new incident begins at the start of the workflow.
Delete Incident removes the incident from the system.
Convert to Service Request moves the incident to the Service Requests application. Files attached to the incident are added to the service request.

In the Classification state, users such as service desk staff can choose from the following:

Attach a file to an incident on the Notes/Attachments tab.
Choose an action such as sending an e-mail from the More Actions menu.

When service desk staff updates or transitions the incident, they can modify data in the incident. The following describes the information to add in the fields, and how the information is used:

The Request Type is usually set automatically during submit; however, technicians may be allowed to override the value.
Choose the Urgency and Impact. Priority is calculated automatically as described in Modifying Urgency, Impact, and Priority, but the value can be overridden.
Use the Caused by RFC(s) field to search for a Request for Change, or RFC, to relate to the incident.
Search for a Configuration Item to relate to the incident. The configuration item categorizes the incident by automatically adding an incident category, incident sub-category, and incident sub-category type (if defined).
Note: Selecting a configuration item is important as the CI is used to show related CIs and to show links to existing problems.
Choose the Reported By user from the list. If necessary, you can also select the Affected User and any other Additional Contacts.
Choose a Level 1 Group that will own the issue until it is assigned to a technician.
After selecting the Configuration Item, you can view other active incidents for that CI by displaying the Active Incidents tab.

Merging or Linking Incidents

Merging or linking incidents creates a parent/child relationship between the incidents that you are merging. The parent becomes the main item, which continues to move through the workflow as updates are performed. The children move to the Linked to Parent state, indicating that they are no longer the main item. When users view the item, they see a note across the top that says "This incident has been MERGED...." The parent issue is then displayed beneath the message.

When the parent is resolved, the children are automatically resolved as well. The resolution notes from the parent are added to the children.

To merge incidents, select the Merge Incident action. On the Merge Details tab, choose whether the incident should become the child or parent:

If you chose the incident to become the Parent:
1. Select the incidents to add as children and click OK.
2. The children will be moved to the Linked to Parent state.
3. The parent continues to move along the workflow.
4. When the parent is resolved, all children are automatically moved to the Resolved state and the parent's resolution notes are added to each child.
If you chose the incident to become the Child:
1. Select the parent to merge into and click OK.
2. The current incident will be moved to the Linked to Parent state while the parent moves along the workflow normally.
  Note: When you view the child, you will see a note about the item being merged and the parent item. Details about the parent item are displayed on the Parent Incident tab of the child; details about the child item are displayed on the Details and System tabs of the child.
3. When the parent is resolved, the incident is automatically moved to the Resolved state and the parent's resolution notes are added to the incident.
Note: To unlink a child from a parent, click Unlink from Parent at the top of the child item.