itsm-email-recommendation

ITSM Email Recommendation

Overview

This skill provides a structured approach to generating professional email responses for IT service management cases. It covers:

Analyzing incident, change, or problem context to craft targeted email responses
Incorporating relevant technical details without overwhelming non-technical recipients
Referencing knowledge base articles and known workarounds in responses
Providing clear next steps and expected timelines for resolution
Generating status update emails for ongoing incidents
Creating closure notification emails with resolution summaries

When to use: When ITSM agents need to send professional, well-structured email responses to end users, stakeholders, or management regarding IT service cases. Particularly useful for complex incidents requiring technical explanation or status updates on high-priority issues.

Plugin required: com.snc.incident (Incident Management)

Prerequisites

Roles: itil, incident_manager, or admin
Access: Read access to incident, change_request, problem, kb_knowledge, sys_email; write access to incident work notes
Knowledge: Familiarity with IT service management processes, SLA requirements, and organizational communication standards
Plugins: com.snc.incident must be activated

Procedure

Step 1: Retrieve the Case Context

Pull the full record to understand the issue, current state, and stakeholders.

Using MCP:

Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: [incident_sys_id]
  fields: sys_id,number,short_description,description,state,priority,impact,urgency,category,subcategory,assignment_group,assigned_to,caller_id,caller_id.name,caller_id.email,caller_id.vip,opened_at,resolved_at,close_code,close_notes,business_service,cmdb_ci,sla_due,made_sla

Using REST API:

GET /api/now/table/incident/[incident_sys_id]?sysparm_fields=sys_id,number,short_description,description,state,priority,impact,urgency,category,subcategory,assignment_group,assigned_to,caller_id,opened_at,resolved_at,close_code,close_notes,business_service,cmdb_ci,sla_due,made_sla&sysparm_display_value=true

Step 2: Review Communication History

Check previous emails to maintain thread continuity and avoid redundancy.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: sys_email
  query: instance=incident^target=[incident_sys_id]^ORDERBYDESCsys_created_on
  fields: sys_id,type,subject,body_text,recipients,sys_created_on
  limit: 10

Using REST API:

GET /api/now/table/sys_email?sysparm_query=instance=incident^target=[incident_sys_id]^ORDERBYDESCsys_created_on&sysparm_fields=sys_id,type,subject,body_text,recipients,sys_created_on&sysparm_display_value=true&sysparm_limit=10

Step 3: Gather Technical Context

Review work notes for diagnostic findings and actions taken.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: sys_journal_field
  query: element_id=[incident_sys_id]^name=incident^element=work_notes^ORDERBYsys_created_on
  fields: value,sys_created_by,sys_created_on
  limit: 20

Step 4: Find Relevant Knowledge Articles

Search for KB articles to reference in the email.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: kb_knowledge
  query: workflow_state=published^short_descriptionLIKE[keyword1]^ORtextLIKE[keyword1]
  fields: sys_id,number,short_description,text
  limit: 5

Step 5: Check for Related Records

Identify related problems, changes, or known errors for context.

Using MCP:

Tool: SN-Execute-Background-Script
Parameters:
  description: Gather related records for email context
  script: |
    var incId = '[incident_sys_id]';
    var inc = new GlideRecord('incident');
    inc.get(incId);

    gs.info('=== RELATED RECORDS FOR EMAIL CONTEXT ===');

    // Related problem
    if (inc.problem_id && inc.problem_id.toString() !== '') {
      var prob = inc.problem_id.getRefRecord();
      gs.info('Problem: ' + prob.number + ' | ' + prob.short_description + ' | Workaround: ' + prob.workaround);
    }

    // Related changes
    var change = new GlideRecord('change_request');
    change.addQuery('reason', incId);
    change.query();
    while (change.next()) {
      gs.info('Change: ' + change.number + ' | ' + change.short_description + ' | State: ' + change.state.getDisplayValue() + ' | Scheduled: ' + change.start_date);
    }

    // Similar recent incidents (for pattern context)
    var similar = new GlideRecord('incident');
    similar.addQuery('category', inc.category.toString());
    similar.addQuery('state', '6'); // Resolved
    similar.addQuery('sys_id', '!=', incId);
    similar.addQuery('sys_created_on', '>=', gs.daysAgo(30));
    similar.orderByDesc('resolved_at');
    similar.setLimit(5);
    similar.query();

    gs.info('\n--- Similar Resolved Incidents ---');
    while (similar.next()) {
      gs.info(similar.number + ': ' + similar.short_description + ' | Resolution: ' + similar.close_notes.toString().substring(0, 100));
    }

Step 6: Generate the Email Response

Select the appropriate template based on the case state and compose the email.

Template 1: Initial Acknowledgment

Subject: [INC Number] - Your request has been received: [Short Description]

Dear [Caller Name],

Thank you for contacting IT Support. We have received your request and created incident [INC Number] for tracking.

Issue Summary: [Short Description]
Priority: [Priority Level]
Assigned Team: [Assignment Group]

What happens next:
- Our [Assignment Group] team will review your request within [SLA timeframe]
- You will receive updates as we investigate
- You can check the status anytime at [Service Portal URL]

If you have additional information to share, please reply to this email or update the incident through the service portal.

Best regards,
[Agent Name]
IT Service Desk
Reference: [INC Number]

Template 2: Status Update

Subject: Re: [INC Number] - Status Update: [Short Description]

Dear [Caller Name],

I wanted to provide you with an update on your incident [INC Number].

Current Status: [State]
Investigation Summary:
[Brief technical summary in plain language]

Actions Taken:
1. [Action 1]
2. [Action 2]
3. [Action 3]

Next Steps:
- [What will happen next]
- Expected timeline: [Estimated timeframe]

[If workaround available:]
In the meantime, you can use the following workaround:
[Workaround steps]

Please let us know if you have any questions or if the situation has changed.

Best regards,
[Agent Name]
IT Service Desk
Reference: [INC Number]

Template 3: Resolution Notification

Subject: Re: [INC Number] - Resolved: [Short Description]

Dear [Caller Name],

I am pleased to let you know that your incident [INC Number] has been resolved.

Resolution Summary:
[Clear description of what was done to resolve the issue]

Root Cause:
[Brief explanation of what caused the issue, if known]

What You Should See:
[Description of expected behavior now that the issue is resolved]

Preventive Steps:
[Any recommendations to prevent recurrence]

For future reference, you may find this knowledge article helpful:
[KB Article Title] - [KB Number]

This incident will be automatically closed in [X] business days if no further issues are reported. If you experience the issue again, please reply to this email or reopen the incident through the service portal.

Best regards,
[Agent Name]
IT Service Desk
Reference: [INC Number]

Template 4: Escalation Notification

Subject: Re: [INC Number] - Escalation Notice: [Short Description]

Dear [Caller Name],

I am writing to let you know that your incident [INC Number] has been escalated to our [Specialized Team] team for further investigation.

Reason for Escalation:
[Brief explanation of why escalation is needed]

What This Means:
- A specialist from [Team Name] will be assigned to your case
- They will have full context from our previous investigation
- You may be contacted for additional details

Updated Timeline: [New estimated timeframe]

We understand the urgency and are committed to resolving this as quickly as possible.

Best regards,
[Agent Name]
IT Service Desk
Reference: [INC Number]

Step 7: Document and Send

Save the recommended email as a work note and optionally add as a customer-visible comment.

Using MCP:

Tool: SN-Add-Work-Notes
Parameters:
  table_name: incident
  sys_id: [incident_sys_id]
  work_notes: |
    === RECOMMENDED EMAIL RESPONSE ===
    Type: [Acknowledgment/Status Update/Resolution/Escalation]
    Recipient: [Caller Name and Email]

    Subject: [Subject line]

    [Full email body]

    === REFERENCES ===
    KB Articles: [KB numbers referenced]
    Related Change: [CHG number if applicable]
    Related Problem: [PRB number if applicable]

Tool Usage

MCP Tools Reference

Tool	When to Use
`SN-Get-Record`	Retrieve full incident/change/problem context
`SN-Query-Table`	Query email history, work notes, related records
`SN-Natural-Language-Search`	Find relevant knowledge articles for email references
`SN-Update-Record`	Update incident with email notification details
`SN-Add-Work-Notes`	Document the recommended email
`SN-Execute-Background-Script`	Gather cross-record context, bulk email generation

REST API Reference

Endpoint	Method	Purpose
`/api/now/table/incident`	GET/PATCH	Read incident and update records
`/api/now/table/change_request`	GET	Find related changes for context
`/api/now/table/problem`	GET	Find related problems and workarounds
`/api/now/table/kb_knowledge`	GET	Search for relevant KB articles
`/api/now/table/sys_email`	GET	Review communication history
`/api/now/table/sys_journal_field`	GET	Extract work notes for technical context

Best Practices

Plain Language: Translate technical jargon into language the recipient can understand; save technical details for work notes
Be Specific: Include incident numbers, dates, and concrete next steps rather than vague promises
Set Expectations: Always communicate expected timelines and what the user can expect next
Reference Self-Service: Point users to KB articles and the service portal for future self-resolution
Maintain Thread: Use "Re:" prefix and include the incident number for email thread continuity
VIP Awareness: Check the caller's VIP status and adjust tone and urgency language accordingly
Proofread for Tone: Ensure the email conveys professionalism and empathy, especially for frustrated users

Troubleshooting

Email History Not Loading

Cause: Emails sent through external systems may not be logged in sys_email Solution: Check sys_journal_field for comments that may contain email content. Review notification logs for delivery status.

KB Articles Not Matching

Cause: Search terms too specific or KB articles categorized differently Solution: Broaden search terms. Try category-based searching. Use SN-Natural-Language-Search for semantic matching.

Email Template Not Fitting the Scenario

Cause: Incident state or context does not match standard templates Solution: Combine elements from multiple templates. Customize based on the specific situation. Always include: current status, actions taken, and next steps.

Recipient Unclear

Cause: Caller and affected user may be different people, or multiple stakeholders need updates Solution: Check caller_id, opened_by, and watch_list fields. For major incidents, use the distribution list from the major incident process.

Examples

Example 1: Network Outage Status Update

# 1. Get incident details
Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: [sys_id]
  fields: number,short_description,state,priority,caller_id.name,business_service,assignment_group

# 2. Get recent diagnostic notes
Tool: SN-Query-Table
Parameters:
  table_name: sys_journal_field
  query: element_id=[sys_id]^name=incident^element=work_notes^ORDERBYDESCsys_created_on
  fields: value,sys_created_by,sys_created_on
  limit: 5

# 3. Draft status update email with technical findings in plain language

Example 2: Resolution Email with KB Reference

# 1. Get resolution details
Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: [sys_id]
  fields: number,short_description,close_code,close_notes,caller_id.name

# 2. Find relevant KB article
Tool: SN-Query-Table
Parameters:
  table_name: kb_knowledge
  query: workflow_state=published^123TEXTQUERY321=[resolution topic]
  fields: number,short_description
  limit: 3

Example 3: Bulk Status Update for Major Incident

Tool: SN-Execute-Background-Script
Parameters:
  description: Generate status update for all users affected by major incident
  script: |
    var majorInc = new GlideRecord('incident');
    majorInc.get('[major_incident_sys_id]');

    // Find all child incidents
    var child = new GlideRecord('incident');
    child.addQuery('parent_incident', majorInc.sys_id.toString());
    child.query();

    gs.info('=== MAJOR INCIDENT STATUS UPDATE ===');
    gs.info('Major Incident: ' + majorInc.number + ' | ' + majorInc.short_description);
    gs.info('Affected Users: ' + child.getRowCount());

    gs.info('\n--- RECOMMENDED BULK EMAIL ---');
    gs.info('Subject: [' + majorInc.number + '] Status Update - ' + majorInc.short_description);
    gs.info('Body: We are currently experiencing [issue description]. Our team is actively working on resolution. Current ETA: [timeframe]. We will provide the next update by [time].');

Related Skills

itsm/chat-reply-recommendation - Chat-based response recommendations
itsm/incident-summarization - Summarize incidents for email context
itsm/kb-generation - Create KB articles referenced in emails
hrsd/email-recommendation - HR-specific email recommendations
itsm/major-incident - Major incident communication workflows

About this skill

Overview

Prerequisites

Procedure

Step 1: Retrieve the Case Context

Step 2: Review Communication History

Step 3: Gather Technical Context

Step 4: Find Relevant Knowledge Articles

Step 5: Check for Related Records

Step 6: Generate the Email Response

Step 7: Document and Send

Tool Usage

MCP Tools Reference

REST API Reference

Best Practices

Troubleshooting

Email History Not Loading

KB Articles Not Matching

Email Template Not Fitting the Scenario

Recipient Unclear

Examples

Example 1: Network Outage Status Update

Example 2: Resolution Email with KB Reference

Example 3: Bulk Status Update for Major Incident

Related Skills

References