major-incident-email

重大事件邮件沟通生成

概述

此技能涵盖在 ServiceNow 中为重大事件生成专业邮件沟通内容：

• 创建初始通知邮件，清晰传达影响、范围和紧急程度
• 编写定期状态更新邮件，说明进展、已采取的行动和后续步骤
• 生成确认服务恢复的解决通知邮件
• 编写事后总结沟通内容，说明根本原因和改进措施
• 针对不同受众（高管、技术人员、最终用户）调整沟通语气和详细程度
• 在所有事件沟通中保持一致的品牌风格和格式

适用场景： 宣布重大事件并需要通知利益相关者时、事件持续处理期间定期更新时、服务恢复时，或事后审查完成后。

前提条件

• 角色： incident_manager、major_incident_manager、itil 或 admin
• 访问权限： 对 incident、sys_journal_field、task_ci、cmdb_ci 表具有读取权限；对 sys_journal_field 具有写入权限，用于记录沟通内容
• 数据： 有字段数据的活动中或最近已解决的重大事件
• 相关技能： itsm/major-incident（完整的重大事件流程）、development/notifications（自动通知设置）

操作步骤

步骤 1：检索事件详情

提取沟通所需的所有相关事件数据。

MCP 方式：

Tool: SN-Get-Record
Parameters:
  table_name: incident
  sys_id: [INC_SYS_ID]
  fields: sys_id,number,short_description,description,state,priority,impact,urgency,business_service,cmdb_ci,assignment_group,assigned_to,opened_at,resolved_at,closed_at,major_incident_state,business_impact,close_notes,resolution_code,u_major_incident

REST 方式：

GET /api/now/table/incident/[INC_SYS_ID]
  ?sysparm_fields=sys_id,number,short_description,description,state,priority,impact,urgency,business_service,cmdb_ci,assignment_group,assigned_to,opened_at,resolved_at,closed_at,major_incident_state,business_impact,close_notes
  &sysparm_display_value=true

步骤 2：确定受影响的服务和用户影响

确定沟通所需的完整影响范围。

MCP 方式：

Tool: SN-Query-Table
Parameters:
  table_name: task_ci
  query: task=[INC_SYS_ID]
  fields: ci_item,ci_item.name,ci_item.sys_class_name,ci_item.busines_criticality
  limit: 20

Tool: SN-Query-Table
Parameters:
  table_name: cmdb_ci
  query: sys_id=[CI_SYS_ID]
  fields: name,sys_class_name,used_for,support_group,location,busines_criticality

步骤 3：检索时间线和活动记录

获取事件时间线，用于状态更新和总结。

MCP 方式：

Tool: SN-Query-Table
Parameters:
  table_name: sys_journal_field
  query: element_id=[INC_SYS_ID]^elementINwork_notes,comments^ORDERBYsys_created_on
  fields: value,element,sys_created_on,sys_created_by
  limit: 50

步骤 4：确定接收群体

确定各类沟通内容的接收对象。

MCP 方式：

Tool: SN-Query-Table
Parameters:
  table_name: sys_user_group
  query: nameINExecutive Leadership,IT Management,Service Desk,Major Incident Management
  fields: sys_id,name,email,manager
  limit: 10

沟通矩阵：

受众	初始通知	更新	解决通知	PIR 总结
高管领导层	是（摘要）	每 2 小时	是	是
IT 管理层	是（详细）	每 1 小时	是	是
受影响用户	是（简化）	每 1 小时	是	否
技术团队	是（完整详情）	每 30 分钟	是	是
服务台	是（沟通要点）	每 30 分钟	是	否
外部客户	视情况而定	每 2 小时	是	可选

步骤 5：生成初始通知邮件

宣布重大事件时，创建第一封沟通邮件。

=== INITIAL NOTIFICATION EMAIL ===

Subject: [MAJOR INCIDENT] [INC Number] - [Service Name] Disruption

---

MAJOR INCIDENT NOTIFICATION

Incident: [INC Number]
Severity: Priority [1/2] - Major Incident
Declared: [date/time] [timezone]

IMPACT
[Service/System Name] is currently experiencing [outage/degradation/intermittent issues].

Affected Service: [business_service]
Impact Scope: [Approximate number of affected users/locations/regions]
Business Functions Affected: [List key affected functions]

CURRENT STATUS
Status: Investigating
Our [team/group] is actively investigating the root cause.

[If known]: Preliminary analysis indicates [brief technical indicator without
speculative root cause].

WORKAROUND
[If available]: Users can [workaround description] as a temporary measure.
[If unavailable]: No workaround is currently available.

NEXT STEPS
- Technical teams are engaged and actively troubleshooting
- A bridge call has been established for coordinated response
- Next status update will be provided by [time]

CONTACTS
Incident Commander: [Name] ([email/phone])
Service Desk: [contact info] for urgent assistance

---
Reference: [INC Number]
Classification: [Internal/Confidential]

步骤 6：生成状态更新邮件

事件处理期间，定期创建更新邮件。

=== STATUS UPDATE EMAIL ===

Subject: [UPDATE #X] [INC Number] - [Service Name] - [Status]

---

MAJOR INCIDENT STATUS UPDATE #[X]

Incident: [INC Number]
Status: [Investigating / Root Cause Identified / Fix in Progress / Monitoring]
Time: [date/time] [timezone]
Duration: [time since incident declared]

CURRENT SITUATION
[1-2 sentences describing current state of the incident]

PROGRESS SINCE LAST UPDATE ([previous update time])
- [Action taken 1 and result]
- [Action taken 2 and result]
- [Key finding or diagnosis update]

ROOT CAUSE
[If identified]: The issue has been identified as [brief, non-speculative description].
[If not identified]: Root cause investigation is ongoing. [What has been ruled out].

IMPACT UPDATE
Current Impact: [Current state of impact - improved/unchanged/worsened]
Affected Users: [Updated count if changed]
[If partial restoration]: [X]% of services have been restored.

PLANNED ACTIONS
- [Next action being taken]
- [Expected outcome and timeline]

ESTIMATED TIME TO RESOLUTION
[If estimable]: We estimate service will be restored by [time estimate with caveat].
[If not estimable]: ETR is currently under assessment. We will provide an estimate
in the next update.

WORKAROUND
[Updated workaround information if available]

NEXT UPDATE
Next status update: [time] or sooner if significant progress is made.

---
Reference: [INC Number]
Incident Commander: [Name]

步骤 7：生成解决通知邮件

创建确认服务恢复的沟通邮件。

=== RESOLUTION NOTIFICATION EMAIL ===

Subject: [RESOLVED] [INC Number] - [Service Name] Restored

---

MAJOR INCIDENT RESOLVED

Incident: [INC Number]
Status: RESOLVED
Service Restored: [date/time] [timezone]

SERVICE RESTORATION CONFIRMED
[Service/System Name] has been restored to normal operation.

RESOLUTION SUMMARY
Root Cause: [Clear, non-technical explanation of what caused the issue]
Resolution: [What was done to fix it]

INCIDENT TIMELINE
- [time] - Issue first reported / detected
- [time] - Major Incident declared
- [time] - Root cause identified
- [time] - Fix implemented
- [time] - Service restored and verified
Total Duration: [hours:minutes]

IMPACT SUMMARY
- Users Affected: [number]
- Services Affected: [list]
- Business Impact: [brief description]
- Duration of Impact: [duration]

WHAT WE ARE DOING TO PREVENT RECURRENCE
- [Immediate preventive action 1]
- [Immediate preventive action 2]
- A Post-Incident Review is scheduled for [date]
- Detailed findings and long-term improvements will be shared after the PIR

USER ACTION REQUIRED
[If action needed]: Please [specific user action, e.g., clear browser cache, restart VPN].
[If no action]: No user action is required. Services should function normally.

FEEDBACK
If you continue to experience issues, please contact the Service Desk at [contact info]
referencing [INC Number].

---
We apologize for any inconvenience this disruption may have caused.
Thank you for your patience during the resolution process.

Reference: [INC Number]
Incident Commander: [Name]

步骤 8：生成事后总结邮件

为利益相关者创建 PIR 总结沟通邮件。

=== POST-INCIDENT SUMMARY EMAIL ===

Subject: [PIR COMPLETE] [INC Number] - Post-Incident Review Summary

---

POST-INCIDENT REVIEW SUMMARY

Incident: [INC Number] - [Short Description]
PIR Completed: [date]
PIR Attendees: [list of key participants]

INCIDENT OVERVIEW
On [date], [Service Name] experienced [type of disruption] lasting [duration].
The incident affected approximately [number] users and impacted [business functions].

ROOT CAUSE ANALYSIS
The root cause was determined to be [detailed but accessible explanation].

Contributing factors:
- [Factor 1]
- [Factor 2]
- [Factor 3 if applicable]

WHAT WENT WELL
- [Positive aspect of response 1]
- [Positive aspect of response 2]
- [Positive aspect of response 3]

AREAS FOR IMPROVEMENT
- [Improvement area 1]
- [Improvement area 2]
- [Improvement area 3]

CORRECTIVE ACTIONS
| # | Action | Owner | Target Date | Status |
|---|--------|-------|-------------|--------|
| 1 | [Action description] | [Name] | [Date] | [Not Started/In Progress] |
| 2 | [Action description] | [Name] | [Date] | [Status] |
| 3 | [Action description] | [Name] | [Date] | [Status] |

METRICS
- Time to Detect: [duration from issue start to first alert]
- Time to Declare: [duration from detection to MI declaration]
- Time to Resolve: [duration from declaration to restoration]
- Total Elapsed: [end-to-end duration]
- Communications Sent: [count]
- Teams Engaged: [count]

QUESTIONS?
For questions about this review, please contact [change manager/incident manager].

---
Reference: [INC Number] | Problem: [PRB Number]

步骤 9：记录已发送的沟通内容

在事件工作备注中记录所有沟通内容，作为审计追踪。

MCP 方式：

Tool: SN-Add-Work-Notes
Parameters:
  sys_id: [INC_SYS_ID]
  work_notes: |
    === COMMUNICATION LOG ===
    Type: [Initial Notification / Status Update #X / Resolution / PIR Summary]
    Sent: [date/time]
    Recipients: [list or groups]
    Channel: Email
    Subject: [email subject line]
    Status: Sent successfully

步骤 10：生成高管专用沟通内容

为高管利益相关者创建精简版本。

=== EXECUTIVE BRIEF ===

Subject: [MAJOR INCIDENT] [INC Number] - Executive Brief

---

[Service Name] - [OUTAGE/DEGRADATION]
Declared: [time] | Duration: [elapsed]

IMPACT: [1 sentence impact description]
STATUS: [1 sentence current status]
ETR: [estimate or "Under assessment"]
ACTIONS: [1-2 key actions being taken]

Incident Commander: [Name] ([contact])
Next Update: [time]

---
[INC Number]

工具使用

工具	用途	使用时机
SN-Get-Record	获取事件详情	任何沟通的起点
SN-Query-Table	检索配置项、时间线和群组	收集范围和背景信息
SN-Update-Record	更新事件中的沟通状态	跟踪沟通情况
SN-Add-Work-Notes	记录已发送的沟通内容	审计追踪
SN-Add-Comment	发布客户可见的更新	面向用户的沟通

最佳实践

1. 主要事件声明后 15 分钟内发送初始通知
2. 面向非技术受众时，使用清晰、没有术语的语言
3. 始终在主题行中注明事件编号，以便追踪
4. 明确下一次更新的时间——不要让相关方不知道何时会收到后续消息
5. 如实说明未知事项——“正在调查”胜过推测
6. 区分内部和外部沟通——内部沟通可以更具技术性
7. 只要有可用的解决方法，就一并提供，方便用户自行处理
8. 使用统一的模板——相关方应能立即识别格式
9. 在事件工作记录中记录每次沟通，以便进行 PIR
10. 发送前校对——仓促发送且有错误的沟通会削弱信任

故障排除

问题	原因	解决方法
无法获取收件人列表	未维护分发组	维护预先定义的主要事件沟通名单
影响范围不明确	未在 CMDB 中映射 CI 关系	根据业务服务进行估算；在沟通中注明不确定性
时间线存在缺口	未持续维护工作记录	根据系统审计跟踪和桥接会议记录进行还原
发送的更新相互矛盾	多人起草沟通内容	指定一名沟通负责人；所有草稿均交由 IC 处理
遗漏相关方	临时通知流程	使用预定义的通知组和检查清单
未收到电子邮件	事件影响了电子邮件服务	使用替代渠道（Teams、短信、电话树）

示例

示例 1：云服务中断

初始电子邮件：

Subject: [MAJOR INCIDENT] INC0098765 - Cloud Platform Service Outage

IMPACT: Cloud Platform services are currently unavailable, affecting
all cloud-hosted applications including CRM, HRIS, and Document Management.
Approximately 3,000 users across all regions are impacted.

STATUS: Investigating - Cloud infrastructure team engaged.
Initial analysis points to a networking component failure in the
primary data center.

WORKAROUND: Users can access CRM via the mobile app (limited functionality).

NEXT UPDATE: By 10:30 AM EST or sooner.

示例 2：支付处理失败

状态更新：

Subject: [UPDATE #3] INC0098801 - Payment Processing - Fix in Progress

Root cause identified: Database connection pool exhaustion due to
a configuration change deployed at 2:00 AM.

PROGRESS: Database team is rolling back the configuration change.
Estimated 30 minutes to complete rollback and restart services.

IMPACT UPDATE: All payment processing remains offline.
Orders are being queued and will be processed once service is restored.
No data loss has occurred.

ETR: 11:45 AM EST

NEXT UPDATE: 11:30 AM EST

示例 3：网络中断后的解决方案

解决方案电子邮件：

Subject: [RESOLVED] INC0098812 - Corporate Network Restored

Corporate network services have been fully restored as of 3:45 PM EST.

ROOT CAUSE: A firmware bug in the core router caused a routing table
corruption during a scheduled update.

RESOLUTION: Firmware rolled back to previous stable version.
Vendor engaged for permanent fix.

DURATION: 2 hours 15 minutes (1:30 PM - 3:45 PM EST)
USERS AFFECTED: ~5,000 across headquarters and satellite offices

USER ACTION: If you experience continued connectivity issues,
please restart your VPN client. Contact Service Desk at x5555
if problems persist.

PIR scheduled for March 25, 2026.

相关技能

• itsm/major-incident - 完整的主要事件管理流程
• itsm/incident-lifecycle - 标准事件管理
• development/notifications - 自动通知配置
• admin/workflow-creation - 自动化沟通工作流