Incident management

Incidents are unexpected disruptions or malfunctions in IT services, encompassing issues such as software crashes, hardware failures, or connectivity problems. Incidents typically require service teams to act fast to minimize the impact on business operations. If an issue affects a large number of users or critical systems and requires coordinated efforts to resolve, it is called a major incident.

Half the trouble of incident management is identifying incidents and finding the correct solution to minimize impact. To that end:

• Atom has been trained to identify incidents and serve the incident form to employees

• Atom uses intent-aware clustering with configurable thresholds for sensitivity, volume, and time window to automatically identify related incidents.

• When thresholds are breached, a channel notification is sent to workspace admins, and a major incident is officially created only upon their acknowledgment.

All Atomicwork workspaces support managing requests and service requests, but only IT workspaces support incident management.

Incident management workflow

1. An employee raises an issue via Slack or Microsoft Teams to Atom.

2. Atom recognizes it as an incident and serves the incident form to the employee.

3. If the incident is submitted through an incident catalog item, Atomicwork routes it to the workspace mapped to that incident catalog. Incidents that are not tied to an incident catalog follow your workspace routing configuration. When multiple eligible workspaces exist for such an incident, admins can configure Smart Routing to assign the workspace automatically or smart suggestions so Atom preselects a workspace and the employee can override it from a dropdown before submission, or requester selection from the list of eligible workspaces.

4. It raises the issue as an incident in the Atomicwork portal, which can be accessed under a new view, available only to agents of an IT workspace, called Incidents.

5. When an organization admin creates an IT workspace, mandatory incident attributes like category, impact, and urgency also get created in the Atomicwork workspace as per ITIL specifications.

6. IT workspace admins can also add custom attributes for incidents.

7. They can create SLAs that apply only to incidents.

8. They can also create and execute workflows for incidents.

9. If multiple related incidents are detected, Atom surfaces a major incident proposal. Workspace admins can approve or decline proposals from the Acknowledgements view or from Slack and Microsoft Teams notifications. Approved major incidents link related incidents automatically. Workspace admins can also create major incidents directly, and agents can promote incidents to major incidents or demote major incidents back to standard incidents where allowed. Read more about major incident management in Atomicwork.

Managing incident attributes

The incident form that will be served to employees when they raise an issue that Atom thinks is an incident consists of the default and custom attributes that an admin has configured as "employee-facing".

Here's how you can view a list of the incident request attributes:

• Go to Settings > Your workspaces > [Workspace name] > Attributes (Service management) and open the Service management tab.

• The Request types column will indicate which attributes are mapped to incident records.

• The default incident attributes are:

  • Agent

  • Status

  • Impact

  • Priority

  • Urgency

  • Category, type and item. These form a three-level classification, for example Hardware > Laptop > Battery replacement. Type was previously called subcategory. We've added some common category and type options as default values.

  • Major incident enabled, which identifies whether an incident is a major incident. You can use it in request views, CSV exports, workflows, SLA policies, and analytics filters.

Priority, impact, and urgency are not editable fields. Admins can create new statuses and categories and modify existing categories.

Modify category and type

• Click the gear icon next to the Category attribute.

• You can add a new category or modify any of the default categories and types.

• When you add a category, you must add at least two types.

• Don't forget to save your changes!

Create a custom attribute

You can create a new custom incident attribute by clicking the Add button. Custom attributes will be displayed to the employee raising the incident as a part of the incident form based on your preferences.

Creating incident workflows

You can set up incident workflows to automatically assign incidents, notify stakeholders, create channels, update attributes, and perform other workflow actions using workflows. Here's how you can set up an incident workflow:

• Go to Settings > Enterprise automation > Workflow library. Select Organization to apply this across the organization, or select a workspace to apply it to that workspace only.

• Click the Incidents tab.

• Click the Create a workflow button.

• A workflow can have events, conditions and actions. Incident workflows can start on any of the request events, such as Request is created, Status is updated, Priority is updated or Resolution SLA is breached. For the full list, see Workflow events.

Actions can involve adding tags, updating attributes (like category, status, priority, or urgency) or third-party actions like creating a Slack channel, creating an Okta user or removing an Azure AD user. Actions executed by a workflow can also trigger other workflows.

Workflows can use the Major incident enabled or is_major_incident condition to target major incidents. Where supported, workflow actions can also update the major incident attribute to enabled or disabled.