Documentation forSolarWinds Service Desk


SWSD is a management tool to help maintain order within your organization. Tickets are opened daily and fit under one of two classifications: Incidents or Service Requests.

An Incident is any unexpected interference to a service, thereby disrupting the normal operations and affecting an end user’s productivity. Incidents can occur due to a number of factors, including an asset malfunction or network failure.

Incident examples include issues related to printers, Wifi connectivity, email service, laptop crashes, Active Directory authentication, and file sharing.

Getting to know your SWSD Incidents

The information provided in this document has been separated into subcategories:

Incident Lifecycle from Creation to Resolution or Close

There are several ways to create (open) a new incident:

  • Via the user portal
  • Via email
  • Through an import from Orion
  • Direct contact with an IT professional. For example, someone from IT who stopped in the hallway and provided assistance could return to his workstation, open an Incident ticket, document the solution, and close the ticket immediately.

Through documented issues and resolutions your organization is able to maintain organized Incident management.

After an incident is created, the incident ticket goes through several states in SWSD before it is considered closed or resolved. It is important to understand the definition of each state to most effectively address the issues contained in the incidents.

State Definition
  • Agent Creation (phone call, walk-up, Skype/Zoom, or other method of contact not listed below).
    Here, your technicians create Incidents on behalf of users who called or contacted an IT professional to report an issue.
  • Email (most common form of Incident creation).
    Effective way for your end users to submit Incidents. It is highly recommended you make sure your Incident forms require all vital information that will allow you to begin addressing the issue at hand. This will prevent time consuming back-and-forth correspondence while you request additional data.
  • Orion.
    All Incidents coming through the Orion platform are entered as an email Incident.
  • Service Portal.
    The Service Portal enables end users to submit Incidents and Service Requests via custom service forms that collect all relevant details for quick and seamless resolution of tickets.
  • Groups.
    A collection of users from the same functional team (for example, IT, Finance, or HR). When an Incident is assigned to a group, you ensure that no ticket goes unnoticed or is delayed if an agent is on vacation or working on other matters. After a ticket is assigned to a group, it can be reassigned as needed.
  • Incident Routing.
    Automatic assignment of Incidents saves time by ensuring all Incidents are visible to the most appropriate team/service agent as quickly as possible. Additional information is available in Understanding Incident Routing in your SWSD.
  • Filtering.
    After Incidents appear on the Incidents Index page, you can filter incidents to view information relevant to your needs. Filtering options include Category, Assignee, and State.
In Progress

The In Progress state is relevant only after the Incident has been assigned and an agent is actively working to resolve the issue at hand. Information relevant to the In Progress state includes:

  • Comments. Comments can be Public (including your end users) or Private (only internal team members will have access to private comments).
  • Relationships. Creating relationships allows you to attach relevant assets, problems, solutions, or other information to the current Incident.
  • States. Ticket States include Escalated to Vendor, Awaiting Input, and more.
Awaiting User

After someone has reached out to the user via the Incident, the Awaiting User state can be used to reflect that you are awaiting a response from the requestor before you can proceed with the Incident.

SolarWinds recommends that you automate a process to ensure that as soon as a public message is received when a ticket is in the Awaiting Progress state, the ticket state automatically returns to In Progress.


The Resolved state reflects that the Incident has been addressed to the best of an agent's ability. A public comment should be entered to let the end user know the issue has been resolved, and a resolution code with comment should be provided.

  • A Resolution Code is a pre-established code that identifies how a ticket was resolved. Resolution codes can be used for reporting purposes.

When resolving a ticket with related incidents attached, you will be offered the opportunity to add the resolution code to all incidents that are related. To attach a resolution code to all related incidents, navigate to the Related tab.
  • A Resolution Comment allows agents to summarize the work done to resolve an issue. Such information can be used to solve future similar incidents.

The Closed state can used to identify an incident that is closed but not resolved. This state can be used in a number of ways. For example, if an agent requested information and the requester did not respond over an extended period of time, the ticket can be closed.

Closed tickets can be reopened. If requester continues to experience a challenge, a new ticket needs to be opened.

Factors to consider

  • What is the most efficient flow through your service desk?
  • How can you ensure tickets don't get overlooked?
  • Do the out-of-the-box states address all the needs of your organization or does it benefit you to also create custom states?

Best Practices

  • Automate the Incident creation process. For example, create tickets automatically when received via email or through the service portal. Be aware that a new incident can evolve from several origins (see the table below).
  • Encourage an organizational environment that uses submission of Service Requests whenever possible rather than break-fix Incidents tickets.
  • Set up queues to automatically route (assign) your Incidents to the correct group or agent (while a ticket is in the queue, it is awaiting assignment).
  • Create relationships among relevant areas of your SWSD. Connect Incidents with similar issues, previous helpful solutions, useful Knowledge Base articles, and more, to enhance the end user experience. You can also attach laptop incidents to their respective assets. The historical record of associated previous incidents can provide justification for replacing a piece of equipment.
  • Automate the updating of ticket states when possible. For example, while a ticket is Awaiting Input (waiting for the requester to provide more information), you might want to ensure that as soon as a public message is received, the ticket state automatically returns to In Progress.
  • Auto-close inactive tickets. If a ticket has awaited a response from the requester for a significant amount of time (5-7 business days), you could automatically set the state to Closed.

Incident Index Table

The Incident Index table is an accumulation of all Incidents in your SWSD. This can include Incidents opened via the SWSD customer portal, email, and/or integrations such as Orion. (Additional information is available on Integrations.)

The Incidents Index table reflects All Incidents by default. (Additional information is available about how to filter, edit, and customize to best meet your needs. More information about views is available in Service Desk Agent.)

Understanding the columns in the Incidents Index table

As mentioned above, it is important to review how to filter, edit and customize your table to provide the information most relevant to your needs. You can choose to display:

  • SLA breaches and Next Breaches (SLA warnings prior to next breach).
    There is a great deal to analyze from this information. For additional SLA details, see Service Level Management.
  • State of the Incident.
    The State can be updated directly from the Incidents table view.
  • Last Assignee change at.
    Shows the timestamp of the last assignment/reassignment.

  • Last State change at.
    Shows the timestamp of the last State change.

  • # of reassignments.
    Shows the current count of reassignments.

  • Incident/Service Request.
    Indicates whether the record is an Incident or Service Request. This is useful for sorting the Incident Index and when exporting for reporting purposes.
  • Site to help with automating tickets.

The Incident Index table can be modified to include more than the information detailed above. It is important to take a moment to review all the column options to determine which details you would like to see in your Incident Index table.

Best practices

To assist with Service Monitoring, SolarWinds recommends that you filter by:

  • First assigned at. Filter the Incident Index by the time records were first assigned.
  • First response. Filter the Incident Index by the time records were first responded to.
  • Open during. Filter the Incident Index by incidents that were open during the time frame you want to review.

Additional features you can utilize and actions you can perform directly from the Incident Index table include:

  1. Triage the ticket
    1. In-line edit. You can perform an in-line edit when hovering over any column to make changes directly.

      For example: Hover over the State to reveal the drop-down menu and change the State from New to Assigned. Other in-line edits will also work.

    2. Eagle eye icon. The eagle eye icon allows you to preview the ticket details. Hovering over the eagle eye will open a new window. If you click the eagle eye, a pane providing additional details will open to the right.
  2. Comment in the ticket
    1. Comment. Enter a private (internal use only - not displayed to end user) or public (visible to everyone) comment by clicking the lock/unlock icon.
    2. @ (at mention). Identify individuals and/or teams to have an email automatically sent to them.
    3. Rich text editing. Use rich text when editing directly from the Incident.
    4. Attachments. By selecting the Attach icon you can attach a file from your computer, dropbox, or an existing solution. Attachments can assist agents in providing faster service.
    5. Post. You can send information directly to the end user by clicking on the Post icon. Make sure the comment is public. Private comments are not shared or visible to the end user.

  1. Agent collision
    If more than one agent is in a ticket at the same time, you will see avatars of the other agents viewing the ticket.

  2. Attachment of solutions
    When you attach a solution in the comment section, the comment is automatically added to the right pane. 
    When you attach directly in the right pane, the information is used for relationship building.

  3. Adding solutions
    As AI becomes familiar with your account, you will find “smart suggestions” to additional related tickets.

The last column on the Incidents Index page, labeled Sentiment, is important to notice as it is used to guide the IT technician in how to proceed. Sentiment uses AI to determine the level of agitation of the requester. If the requester is already agitated, then it is best to give his Incident priority and resolve it as soon as possible.

Icons on your Index Screen

In addition to all the features listed above, notice the five button icons in the upper right corner of the screen.  These icons are found throughout your SWSD on the following screens: Incidents, Problems, Changes, Releases, Solutions, and Service Catalog.  A subset of these icons are on the CMDB screen as well.

  1. In-context search . By entering keywords such as New, Assigned, Resolved, etc., you can limit your search to reflect only Incidents in the respective states.
    1. There are a number of ways to refine your search :
      • Type an asterisk (*) at the end of a word search to see results containing the specified letter sequence.
      • Type Description:gmail for all incidents with gmail in the description.
      • Type State:New for all new tickets.
      • To identify a specific user:
        • Type Requester:first name to search for specific requester.
        • Type Assignee:first name to search for specific assignee.
        • Type comments:first name to view sent and received comments.

        If you have enabled any filters within your in-context search, be aware that search will be limited to only items matching the filter criteria.

  2. The Add icon allows you to create a new incident and/or attach a Problem, Change CI, etc.
    Learn more about Creating a New Incident.

  3. The Actions button serves multiple purposes. You can:
    1. Select and open the drop-down menu, which allows you to access:

      • Mass Update
      • Login History
      • Import (Very helpful during the onboarding phase; proper import allows you to easily transfer existing data into your SWSD.)

        Prerequisite for importing custom fields data: The custom fields should be defined in SWSD prior to import. To accomplish this:
        • Select the Import button.
        • Choose a file.

        • Map the fields in the source file to the corresponding target attributes.

      • Export via CSV, XML, PDF, and more.

    2. Review information for a specific Incident (click the Incident title to reveal the details page).
      Here you will find the button, from which you can:

      • Merge.
      • Clone.
      • Export the Incident to PDF.

        When you select PDF Export, a menu appears that allows you to select which tab(s) you want to export. For example:
        • Details tab

        • Comments tab

        • Related tab

  4. The Question icon reveals additional information and a tutorial on how to better understand your tasks.

Look at an Individual Incident

Let's look at individual Incidents from the Incident Index page.

Select an Incident name from the Incident Index page.

  • This reveals a new window with Incident details such as Name and any additional information entered about the Incident created.

  • On the right pane of the screen, you will find associated details, such as:

Creating a New Incident

Open a New Incident window and enter all the details requested. 

As soon as you begin entering information in the Incident title, notice the AI list that appears on the right of your screen:

  • Similar Incidents. A direct link to all incidents that have similar key terms.
  • Smart Solutions. A direct link to all solutions that have worked in the past.

This helps you quickly and efficiently address the issue without needing to wait for agent intervention.

If you are unable to resolve the issue on your own, then complete the requested details and scroll to the tabs on the bottom.

  • Related Tabs is a simple way to attach related ITSM objects to the current Incident. Attaching related ITSM objects allows you to:
    • Consolidate resolution of tickets.
      When you resolve the main ticket you’re working on, you will be given the option to resolve all attached incidents.
    • Escalate to a problem or a change.
      You may have noticed a larger trend with the incoming tickets and may want to escalate to a problem or a change. Attach the common tickets and create a problem or change record from the incident record to build the hierarchy of the escalation.
  • The Tasks tab is used to set up a work flow to resolve the issue.

Identifying Redundant tickets

Sometimes users submit the same ticket more than once. The AI built into your SWSD recognizes such duplicates and highlights them to allow you to consolidate the effort of resolving the ticket.

After you have entered all the information available to you, click Create to save your information. Take notice, your New Incident form is intuitive and interactive. Most fields provide a user-friendly drop-down menu, and many factors have been taken into account to ensure the incident is resolved as smoothly as possible by gathering all relevant details as soon as the form is completed.

Actions Available Directly from the Incident

Directly from this form, you can utilize the details provided in the tabs such as, Comments, Details, Related, etc., to gain further insight into the Incident.

For example:

  • In the Comments tab you can find general information added by a technician.
  • In the Related tab, click Actions to reveal a drop-down menu. When you select Changes, a new window appears where you can choose from approved CCI templates to streamline and accelerate Change Requests and execution of Incidents.

Understanding Incident Routing in your SWSD

Incident routing is an imperative action that can be automated by your Service Desk. Automatic assignment of incidents created will save time by ensuring all incidents are visible to the most appropriate team/service agent as quickly as possible so they can begin addressing the issue at hand.

As the Administrator, you can set up rules to route Incidents based on a variety of factors. Below we provide examples of common use cases. Route tickets based on:

  • Account Default Assignee
  • Sites
  • Departments
  • Categories
  • Subcategories
  • Service Catalog Default Assignees
  • Automations

Setting Up Incident Routing

Select the most appropriate path to ensure fast and efficient handling of each Incident routed through your SWSD.

Account Default Assignee

A default assignee can be selected for all new incidents created. This is most beneficial when un-categorized tickets are created in the system from incoming emails.

Default Assignee and Notifications

You can select a default assignee to receive notifications upon creation of each new incident.

Sites or Departments

If you determine the best route for a ticket is for it to go to a specific site or department, you can select the site or department as a default path. For example:

  • Site (could be used for all Incidents originating from the New York office to route them to the New York site).
  • Department (could be used for all IT-related Incidents, regardless of location, to route them directly to the IT department).

You can select a default Site or Department when creating a new site/department or when editing an existing record.

Category or Subcategory

You can set the category or subcategory as a key word that determines the best route for an Incident.

For example, whenever the category is desktop, the ticket could get assigned to the IT Help Desk.

Service Catalog Default Assignee

A Default Assignee can be selected for each Service Catalog item created. This can be selected when creating or editing each item.

Automation Rules

SWSD provides a number of default assignments that can route tickets quickly and efficiently. If you set up multiple automation rules, the ticket will quickly be filtered after it is created in the system. The latest rules will take precedence and if no rule applies, the ticket remains unassigned.

Converting Incidents into a Service Request

At times, requesters open an incident rather than submitting a service request. When you come across such an issue, it is easy to change the ticket type.

Watch an instructive video or review the steps below:

  1. From your Incident Index page, select the relevant incident and click on the Incident title.
  2. In the upper right-hand corner, click Actions and select Convert to Service Request from the dropdown menu.

  1. Select the relevant Service Request, and then click Next.
  2. The Convert to Service Request window appears. Hover over the window, then move it around to uncover relevant data on your main screen. This allows you to copy and paste needed information from the original Incident into the new Service Request.
  3. Click Convert.

    The Incident number will not change, which ensures that anyone subscribed to the original Incident will continue to receive relevant notifications.