Concept · entity · registered
Incident
An unplanned interruption to a service, or a reduction in its quality. The incident is that interruption. Restoring the service is why it is handled, and can finish before the cause is understood. A problem is the cause, or a potential cause, and can sit behind several incidents. A service request asks for a service action already agreed as normal delivery; nothing has to have failed. A bug is a flaw recorded as delivery work and may never reach a running service. An incident can also come from configuration, capacity, or a dependency, with no bug. A change request proposes a modification. An emergency change may be what restores the service; the request is still not the incident.
Definition
What Incident means
Used in data
In OVDB databases
Databases, recordsets and fields whose meaning is this concept, a kind of it, or whose values are instances of it. Rows open the OVDB Directory.
No OVDB database carries this concept yet.
Properties
What we can say about Incident
These properties describe meanings and reference targets. Storage types, required fields, and cardinality belong to the consuming data model.
| Property | Meaning | Values and units |
|---|---|---|
| Incident affected service | The service whose quality is interrupted or reduced. A failing software component may be what broke the service; the service is still what the users were promised. | Values reference Service |
| Incident failure at | The instant the service was interrupted or its quality dropped, when that instant is known. The record may have been opened later. Mean time to restore is measured from this instant, not from the opened time and not from acknowledgement of an alert. | Scalar meaning |
| Incident impact | The effect of this incident on users or on a business process, such as which work is blocked. Impact is not urgency and not priority. It is not severity, the operations grade of the impairment. Teams often align the grade and the effect, and the two can still differ. | Scalar meaning |
| Incident opened at | The instant the incident was recorded. The service may have failed earlier; that instant is the incident failure time when it is known. This instant is not when the service was restored and not when a person acknowledged an alert. | Scalar meaning |
| Incident priority | The order in which responders work this incident. It is often chosen from impact and urgency, and a person can override that suggestion. The attribute stores the resulting order, not the impact and not the urgency. It is not severity, which grades the impairment, and it is not the support tier that holds the ticket. | Scalar meaning |
| Incident related bug | A bug recorded as a cause of this incident, when the harm comes from a software flaw. The attribute is absent when the cause is something else. Linking the two does not make the incident a bug or the bug an incident. | Values reference Bug |
| Incident resolved at | The instant the incident record was marked resolved, often because a workaround or a fix is in place. That can be earlier or later than the instant the service was restored. | Scalar meaning |
| Incident restored at | The instant the service met its success criterion again. Mean time to restore ends at this instant, not at the resolved time of the record and not at the time an alert was acknowledged. | Scalar meaning |
| Incident severity | How badly the service is impaired, on the scale the organization uses for operations. A low number is not universally the worst grade. Severity is not impact, which is the business effect, and not urgency, which is how soon restoration is needed. It is not priority. Priority is the order of work and can diverge from the grade: a severe fault in a service with no users until morning is not the same queue position as a moderate fault that blocks today's payroll. ITIL names impact, urgency, and priority for this ordering, and does not define severity as that order. | Scalar meaning |
| Incident status | Where this incident sits between being recorded and being closed. Practices often distinguish open, restored and resolved, but the names belong to the practice. Status is not severity. Resolved, on the record, can differ from restored, on the service. | Scalar meaning |
| Incident urgency | How quickly the business needs the service restored. Urgency is not impact. A severe impairment of a service that nobody needs until morning can have low urgency. Practices often suggest a priority from impact and urgency. Incident priority stores the order that was chosen, including when a person overrides that suggestion. | Scalar meaning |
| Incident workaround | A way to reduce or avoid the impact of this incident without removing the cause. It may restore the service for now. It can be found before any problem has been analysed. It is not the root cause and not a permanent removal of the cause. | Scalar meaning |
In the graph
Related concepts
Concepts whose values are instances of it
The incident this document reviews. Writing the document does not reopen or replace the incident.
An incident this problem is taken to explain. One problem can sit behind several incidents. The incident remains the record of restoring the service.