ITIL Incident Investigation and Diagnosis
ITIL incident investigation and diagnosis is applied when an incident cannot be resolved as part of the initial diagnosis.
A common practice in this phase is the attempt to recreate the incident under controlled conditions. It is important when performing incident investigation and diagnosis that the proper order of events that lead up to the incident be understood.
Incident investigation and diagnosis is the sixth step in the incident management process. It follows incident escalation.