Incident management information, tools and technology
Domain 4 tests what information an incident record must hold, how tools support detection through closure, and how CMDB, knowledge, monitoring, automation and reporting contribute to effective incident management.
Incident record data
A useful record includes a unique ID; timestamps for detection, resolution and closure; reporter and affected users; affected services and configuration items; symptoms; impact, urgency and priority; category; status; assignment group and owner; workaround and resolution; closure code; linked problem, known error, change and major incident flag; and a communication log.
Tooling layers
- ITSM workflow: routing, SLA timers, escalation and audit trail.
- Monitoring and event management: detect anomalies, correlate alerts and create incidents automatically.
- CMDB: show CI relationships to assess impact and route to the right support group.
- Knowledge management: known-error database, diagnostic scripts and self-help.
- Service portal, chat and virtual agent: intake and status updates.
- Collaboration and notification: bridges, status pages and stakeholder alerts.
- Automation and AI: auto-categorization, suggested resolutions, auto-healing for known patterns and chatbot triage, with human override and governance.
Reporting
Track volume by category and service, mean time to restore, SLA attainment, reopen rate, major incident count, first-contact resolution and aging backlog. Use the data for improvement, not just dashboards.
Worked example
Monitoring detects elevated API latency. Event correlation creates one incident instead of 200 alerts. The CMDB shows the API depends on a database cluster, so the incident routes to the database team rather than the network team. A knowledge article suggests a connection-pool setting, which resolves the incident, and the article is updated. Reasoning: correlation cuts noise and misrouting; CI data and knowledge reuse shorten diagnosis.
Traps that cost marks
- Incomplete records with no CI link or closure code, making reporting useless.
- Auto-closing without confirmation.
- Treating AI suggestions as authoritative.
- Keeping workarounds only in chat.
- Measuring only average resolution time, which hides major incidents and the tail.
- Allowing uncorrelated alerts to create duplicate incidents.