Dark Mode
Enterprise Incident Management Records
Retail & Consumer Behavior
Tags and Keywords
Trusted By
"No reviews yet"
Free
About
This dataset provides an event log of an incident management process, extracted from the audit system of a ServiceNow™ platform instance utilised by an IT company. The log has been enriched with additional data from a corresponding process-aware information system, with all sensitive information anonymised for privacy. It captures the full lifecycle of incidents, from opening to closure, making it ideal for analysing process transitions and predicting incident resolution times.
Columns
The dataset comprises 36 attributes, offering detailed insights into incident management:
- number: Unique identifier for each incident.
- incident state: Describes the eight stages an incident progresses through.
- active: A boolean indicating if the incident record is currently active, closed, or cancelled.
- reassignment_count: The total number of times the incident’s assigned group or support analyst has changed.
- reopen_count: The number of occasions the incident resolution was rejected by the original caller.
- sys_mod_count: The cumulative count of updates made to the incident record up to a given point.
- made_sla: A boolean indicating whether the incident exceeded its Service Level Agreement (SLA) target.
- caller_id: Identifier for the user impacted by the incident.
- opened_by: Identifier for the user who initially reported the incident.
- opened_at: Date and time when the incident was opened by the user.
- sys_created_by: Identifier for the user who registered the incident in the system.
- sys_created_at: Date and time of the incident’s system creation.
- sys_updated_by: Identifier for the user who last updated the incident, generating the current log record.
- sys_updated_at: Date and time of the most recent system update for the incident.
- contact_type: Categorical attribute indicating how the incident was reported (e.g., email, phone).
- location: Identifier for the geographical location affected by the incident.
- category: The primary classification describing the affected service.
- subcategory: A secondary, more granular description of the affected service, linked to its category.
- u_symptom: A description of the user's perception regarding service availability or issue.
- cmdb_ci: Identifier for the affected Configuration Item (CI), though not always mandatory.
- impact: Describes the severity of the incident's effect (1–High; 2–Medium; 3–Low).
- urgency: Describes the user-defined importance of resolving the incident (1–High; 2–Medium; 3–Low).
- priority: System-calculated priority based on both 'impact' and 'urgency'.
- assignment_group: Identifier for the support group responsible for the incident.
- assigned_to: Identifier for the specific user currently handling the incident.
- knowledge: A boolean indicating if a knowledge base document was referenced during resolution.
- u_priority_confirmation: A boolean showing if the priority field was double-checked.
- notify: Categorical attribute indicating if notifications were generated for the incident.
- problem_id: Identifier for any associated problem record.
- rfc: Identifier for any Request for Change (RFC) linked to the incident.
- vendor: Identifier for any external vendor involved in the incident.
- caused_by: Identifier for the RFC that caused the incident.
- close_code: Identifier for the resolution reason of the incident.
- resolved_by: Identifier for the user who resolved the incident.
- resolved_at: Date and time when the incident was resolved by the user.
- closed_at: Date and time when the incident was formally closed by the user.
Attributes containing textual information are deliberately excluded, and missing values should be interpreted as unknown.
Distribution
The dataset is primarily available in CSV format and includes 141,712 events across 24,918 unique incidents. It features 36 attributes, consisting of one case identifier, one state identifier, 32 descriptive attributes, and two dependent variables (
resolved_at and closed_at). The dataset's size is approximately 39.15 MB (Version 2). Specific numbers for rows/records are available.Usage
This dataset is particularly suited for developing machine learning applications aimed at predicting the estimated time and date for the final closure of opened IT tickets. It can also be utilised for in-depth analysis of incident management processes, optimising IT service delivery, and identifying bottlenecks in support workflows.
Coverage
The dataset stems from an IT company utilising the ServiceNow™ platform, implying a focus on enterprise IT service management. While specific geographic or demographic details are anonymised, the data captures incident handling over a period defined by various date and time attributes such as
opened_at, resolved_at, and closed_at. The information has been carefully anonymised to protect privacy, and attributes related to textual descriptions of incidents are not included.License
CC0: Public Domain
Who Can Use It
This dataset is invaluable for data scientists and machine learning engineers looking to build predictive models for IT service management. IT operations managers and business analysts can leverage it for process improvement, performance monitoring, and resource allocation. Researchers in fields such as process mining and business process management will also find this dataset highly relevant for academic studies.
Dataset Name Suggestions
- ServiceNow Incident Event Log
- IT Incident Resolution Prediction Data
- Enterprise Incident Management Records
- Service Desk Ticket Lifecycle
- ITSM Incident Analysis Dataset
Attributes
Original Data Source: Enterprise Incident Management Records
QUALITY