Active major incidents

Major incidents demand immediate clarity. The first question in any war-room is simple: How many major incidents are active right now?

This tile provides that answer in a single, unambiguous signal. It surfaces live Priority 1 incidents and turns them into an instant operational indicator.

When the number is zero, the system is calm. When it isn’t, you know you’re in an active event.

Before you begin

This tile works best when paired with:

• Major incident status
• Ticket creation rate
• Major alert volume

Those tiles explain how the incident is evolving, while this one tells you whether one exists in the first place.

Configuring the tile

Configure the following in the tile editor:

1. Data Source: Select ServiceNow.
2. Data Stream: Select Table Query.
3. Parameters:
   1. Table name: Select Incident.
   2. Filter query: Enter a query to return your major incidents. For example, active=true^priority=1.
   3. Result type: Select Aggregate.
   4. Show count only: Select this check box.

4. Timeframe: Select the timeframe you want to track. Note that after adding a monitor or configuring a KPI the Use dashboard timeframe option is disabled.

5. Visualization: Select Scalar.
   1. Mapping > Value: Count is automatically selected.
6. Click Save.

Adding a monitor

Adding a monitor turns this value from a passive count into an operational signal. No major incidents indicate that the system is healthy.

Even a lone major incident should raise alarms, therefore, we'll configure the monitor to fire an error whenever one or more major incidents arise.

Configure the following in the tile editor:

1. Monitoring: Enable the toggle.
2. Type: Select Threshold.
3. Value: Select Count.
4. Conditions > Error: Select greater than and enter 0.
5. Click Save.

Was this article helpful?