Review and update a post incident report

Review a post incident report (PIR) using the Post Incident Report tab. A PIR helps you review and understand the cause of the major incident and the actions taken by the teams to resolve the incident. This helps prevent the issue in the future.

Before you begin

The major incident must be in the Resolved state. For more information, see Resolve and close a major incident.

Role required:

• For PIR review: sn_incident_read or sn_incident_write
• For PIR update, generate and download: major_incident_manager, incident_write (added as co-contributors) or admin

About this task

Reviewing the post incident report (PIR) also provides an opportunity to evaluate the incident response process and identify areas for improvement. The PIR can be reviewed and updated during the review process before it's shared with stakeholders.

After you resolve a major incident, you must publish the PIR for the major incident and share it with the stakeholders within a specified time duration as defined in the SLA. You can configure the SLA by specifying the value in hours in the PIR publish hours (sn_sow_inc.pir.publish.hours) system property.

Tip: For guidelines on customizing the Post Incident Report layout and content, search the ServiceNow Community for customize post incident review report.

The following events are captured in the timeline of the PIR:

• Incident created
• Incident proposed as major incident
• Incident accepted as major incident
• Incident resolved
• Incident closed
• Custom events
• Incident task created
• Incident task closed

Procedure

1. Open a major incident record that is in the Resolved state.

2. Select the Post incident report tab.

3. On the Incident Response Timing section, review the time duration for the following fields.

Time to identify = (incident created time) - (incident proposed time)

Time to identify = (incident created time) - (incident promoted time)

Time to response = (incident proposed time) - (incident promoted time)

Time to resolve = (incident promoted time) - (incident resolved time)

1. On the Contributors section, add users to help with creating and publishing the PIR.

   1. Select the Edit Co-contributors (

2.  In the **Co-contributors** field, enter users or user groups.

3.  Select the **Save Co-contributors** \(

1. On the Incident summary section, review the incident summary information and edit as needed.

   Note:

   By default, this section retrieves the incident summary information from the Overview tab. You can modify the values.

   1. Select the Edit report (

2.  Edit the following information.

    -   Summary
    -   Impact
    -   Resolution
3.  Select the **Save report** \(

1. On the Timeline section, review the incident events timeline and edit as needed.

   1. Select the Edit Timeline (

2.  Select the **Add event** option, enter the following information, and then select **Add** to add a new event to the timeline.

    |Field|Description|
    |-----|-----------|
    |Select date and time of the event|Date and time of the event.|
    |Enter short description of the event|Brief description of the event.|

3.  Edit the event timeline with the following setting options.

4.  Select the **Save settings** \(