News in SCSM12 (Beta) #5 – Parent/Child Incidents

With SM12 it’s now possible to link multiple Incidents together. For that, a Parent Incident (or Master Incident) is created that then has relations to one or multiple Child Incidents. With SM10 this was only possible by linking multiple Incidents to Problem Records – which was not always a good way to go because the idea behind Problem Records is to find the root cause and to make sure you get less Incidents from this kind in the future.

The complete SCSM SM12 (Beta) Series:
#1 – Service Level Objectives (SLO)
#2 – Service Requests
#3 – Automation of Service Requests
#4 – Enable Self-Service for Service Requests
#5 – Parent/Child Incidents
#6 – Release Management
#7 – Connectors
#8 – Permissions for triggering System Center Orchestrator runbooks

Now let’s see how this works. First we need to configure the Parent/Child Incident behavior in the global settings.


As you can see there are multiple options to configure the behavior when Incidents are resolved or reactivated. And you can automatically change the status of Child Incidents if needed.


Now let’s see how Incidents can be attached to a Parent Incident. For this I created multiple regular Incidents. Just mark those that should be bundled together and click on the appropriate task. You can either create a new Parent Incident or attach them to an already existing Parent Incident. In this example I create a new Parent Incident.


Select a Template for the new Parent Incident and configure it as needed.



Check that “Child Incidents” tab. It shows all Child Incidents that are attached to your Parent Incident. You can also use this area to add or remove Child Incidents.


After the Parent Incident is created, you can find all Parent Incidents easily in the appropriate view. Now let’s resolve the Parent Incident and see what happens.


Based on the global configuration we did at the very beginning, the Child Incidents are automatically resolved when the Parent Incident is resolved.


After the Parent and all Child Incidents have been resolved, let’s try to reactivate the Parent Incident. Again the behavior is based on the global configuration. In our example, I can choose if I want to reactivate all linked Child Incidents.



This new feature is really a step forward to professional, effective Incident Management and a much better solution than using Problems for this. Of course, there may be situations where you still want to link Incidents to Problems for root cause analysis, but as this is not always the case, we now have much more flexiblility.


About Marcel Zehner

Microsoft Azure MVP
This entry was posted in SCSM and tagged , , , , , , , , . Bookmark the permalink.

12 Responses to News in SCSM12 (Beta) #5 – Parent/Child Incidents

  1. Pingback: News in SCSM12 (Beta) #1 – Service Level Objectives (SLO) |

  2. Pingback: News in SCSM12 (Beta) #4 – Enable Self Service for Service Requests |

  3. Pingback: News in SCSM12 (Beta) #6 – Release Management |

  4. Pingback: News in SCSM12 (Beta) #3 – Automation of Service Requests |

  5. Pingback: News in SCSM12 (Beta) #2 – Service Requests |

  6. Pingback: News in SCSM12 (Beta) #7 – Connectors |

  7. Pingback: News in SCSM12 (Beta) #8 – Permissions for triggering System Center Orchestrator runbooks |

  8. Pingback: SCSM.SE » Blog Archive » Parent incident suggestion function

  9. Vamshi Gupta says:

    Hi Marcel,
    Once the Incident request is attached to Parent Incidnet, would it be possible for child incident to have same logs replicated as parent .
    In this way QA would not have to go through Parent and Child ticket both.. but rather can know from child ticket itself, everything done on parent Inclidnt.

    • Marcel Zehner says:


      Good question! I have not done this myself. But I guess you could use SCORCH for this task. Monitor for new Action “Analyst Comments” in the Action Log of Parent Incidents, then write those down to all Child Incidents. Let me know if that works. If I find some time I will try it out myself, but this could take a while 🙂

      cheers Marcel

  10. Stephen Dannon says:

    Ive looked everywhere and I cant find any articles that explain how to use SCORCH to create a child incident and assign it to an existing parent. I must be missing something because this seems like an extremely usefull thing to automate.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s