3. Incident Investigation and Diagnosis

If the initial support fails to resolve the incident, the IT Service desk staff can transfer the incident to a Subject Matter Expert (SME). The SME investigates the incident, adds details, and, if possible, resolves the incident. Other options include escalating the incident to another SME or posting an RFC to the change management group.

The default incident management workflow contains three levels of support. Each level is associated with a different user field as described below:

Investigation and Diagnosis state – Level 1 Technician
Investigation Queue state – Level 1 Group
Escalated to L2 state – Level 2 Technician
Note: The Level 2 Technician list includes users who are in the Level 2 Tech and Level 3 Tech roles. This allows a Level 3 Tech to be selected to handle a lower level incident if the technician is available.
L2 Escalation Queue state – Level 2 Group
Escalated to L3 state – Level 3 Technician
L3 Escalation Queue state – Level 3 Group

Depending on the state, the SME or technician can choose from the following actions:

Resolve the incident, supplying how it was resolved and any other resolution details.
Escalate the incident to the next level; for example, escalate the issue from level 2 to level 3.
Post RFC to create a request for change from the incident. The incident moves to the Pending Change state. It will return to the Investigation and Diagnosis state after the related change is closed.
Post Problem to either create a new problem or choose an existing problem (only available above level 2). To create a new problem, choose Create New Problem from the Problem Link list. To link to an existing problem, choose Link to an Existing Problem and search for the existing problem under Raised Problem. The linked problem appears on the Linked Problem tab. The link can be removed by selecting Remove Problem Link from the Other drop-down list.

Tip: You can configure SBM to automatically assign the correct owner for each state. This improves the user experience by eliminating the need for them to select the correct SME when escalating the incident.

From the "queue" states, individual technicians use the Assign action to assign the incident to themselves.

Similar to the Classification state, the investigation states provide the following additional actions:

Reassign assigns the incident to another technician or moves it back into the group queue.
Merge Incident ties the current incident to another existing incident using Parent/Child relationships. See Merging or Linking Incidents.
Copy Incident creates a duplicate of the incident. You cannot modify the values when the item is created.
Post New Incident creates another incident based on the current incident. You can modify the values on the Submit form for the new incident.
Delete Incident removes the incident from the system.
Convert to Service Request moves the incident to the Service Requests application.