The Incidents report gives you comprehensive visibility into how your team identifies, responds to, and resolves service disruptions. Track incident volume, response times, resolution performance, and backlog composition to identify patterns and improve your incident management process.
While you can view incident data by filtering the Overview or Request Aging reports by request type, the Incidents report is purpose-built for incident managers. They include incident-specific breakdowns like most/least reported forms and categories, and are pre-filtered to show only incidents, saving you from manual configuration every time.
To access this report, navigate to Analytics > [Workspace name] > Incidents in the left navigation bar.
Report filters
You can refine the data shown in the report using the global filters at the top of the page. These filters apply to all widgets and metrics on the dashboard.
Duration: Select a time period such as the last 6 months, last quarter, or last year.
Attributes: Filter by specific incident attributes including Status, Priority, Impact, and more.
For example, to analyze urgent incidents assigned to the Engineers group from the past month, set Duration to Last month, Group to Engineers, and Priority to Urgent. This helps you identify if a specific team is being overwhelmed with critical incidents.
Understanding incident analytics
Metric | Description | Why it matters |
Total incidents created | Shows the total volume of incidents reported within the selected duration. | Tracks incident trends over time. A sudden spike may indicate a systemic issue or outage. |
Created vs completed | Compares the number of incidents created against those completed over time. View trends on a Daily, Weekly, or Monthly basis. | Reveals whether your backlog is growing or shrinking. Consistent gaps signal capacity issues or inefficient resolution processes. |
Time to first response | Measures how long it takes from incident creation until an agent first responds. Toggle between Median and Average views. | Indicates how quickly your team acknowledges incidents. Long response times can erode employee trust and delay resolutions. |
Time to resolution | Shows how long it takes to fully resolve incidents from creation to closure. Toggle between Median and Average views. | Reveals overall incident management efficiency. Compare against SLA targets to identify where improvements are needed. |
First response SLA compliance | Percentage of incidents where the first response met the defined SLA target. Shows Hit (compliant) vs Miss (breached). | Measures how well your team meets response commitments. Low compliance indicates need for better routing, staffing, or SLA definitions. |
Resolution SLA compliance | Percentage of incidents resolved within the defined SLA target. Shows Hit (compliant) vs Miss (breached). | Tracks resolution performance against commitments. Identifies if SLA targets are realistic or if process improvements are needed. |
Unresolved incidents by Status | Shows where open incidents are stalled: Open, Pending, Waiting for approval, Waiting on vendor. | Pinpoints bottlenecks. If most incidents are "Waiting on vendor," you may need better vendor SLAs or escalation processes. |
Unresolved incidents by Impact | Shows the distribution of active incidents across Medium and High impact levels. | Helps prioritize team focus. A backlog heavy with high-impact incidents signals urgent capacity or process issues. |
Most reported incident forms | Shows which incident types (e.g., Plumbing issues, Battery Drain Issue, Device audio issues) are generating the most reports. | Identifies recurring problem areas. High volumes in specific categories suggest opportunities for preventive measures or knowledge articles. |
Least reported incident forms | Shows incident types with the lowest report volumes. | Helps identify rarely-used forms that may need review, or areas where proactive maintenance is working well. |
Most reported categories | Shows the top 5 categories (e.g., Hardware, Facilities) generating the most incident reports. | Identifies which areas drive the most incident volume. High concentration in one category may indicate recurring issues or inadequate preventive measures. |
Least reported categories | Shows the bottom 5 categories with the lowest incident volumes. | Helps identify rarely-used categories that may need review, or areas where proactive measures are working well. |
Age of incidents | Groups open incidents into time buckets to show how many fall into each age range. Buckets are dynamically sized based on your data. | Shows backlog composition by age. A large number of old incidents indicates process bottlenecks or deprioritization of certain types. |
Employee satisfaction by week | Tracks satisfaction scores from employees who submitted feedback after their incident was resolved. | Measures how well your incident resolution process meets employee expectations. Declining scores may indicate longer resolution times, poor communication, or quality issues. |
You can analyze these metrics in combination to diagnose specific issues and drive improvements. For example, say you notice:
Created vs completed shows incidents being created faster than they're resolved (60 created, 8 completed)
Unresolved incidents by Status reveals most are stuck in Open status
Most reported incident forms shows WiFi connectivity issues dominating
Time to first response averages 2 days 23 hours
First response SLA compliance is only 5.8%
This means, WiFi-related incidents are overwhelming your team. They're not being responded to quickly (2+ days), causing severe SLA breaches, and creating a growing backlog of unresolved incidents.
What you can do:
Create a verified answer or troubleshooting guide for common WiFi issues (wrong network, password reset, router restart)
Review if WiFi incidents need dedicated routing to Network Engineering vs. general IT helpdesk
Investigate if the spike indicates a broader infrastructure issue (failing access points, network configuration problems) rather than individual user problems
Drilling down and exporting data
You can click on any metric or graph segment to open a detailed view of the underlying incidents. The drill-down view lets you:
View a list of all individual incidents contributing to that metric
See details such as Subject, Requester, Groups, Category, Incident Form, Impact and more
Add or remove columns to customize the view
Apply additional filters to refine the list further
You can also download the data from any widget or drill-down view as a CSV file for external analysis, stakeholder reporting, or custom calculations.
To export data, open a drill-down view and click on Download as CSV at the top right.