What are the steps in Incident Management?

First you need to confirm it is an incident not an event, then you need to apply proper step to ensure it will not expand. You need to protect or preserve evidence from modification and follow on investigation and reporting. Last you need to develop a lessen learn to prevent such incident to reoccur.

incident reporting ( from the users)

second is the first level of incident diagnosis and forwarding to the concerned team ( usually done by help desk).

third is the resolve ( from the concerned team)

fourth is the report from that team if the incident is solved or need participation of other stake holders in case the resolve is temporary and need further attention for future.

There are major four steps/phases of incident response process.

• Preparation
• Detection and Analysis
• Containment, Eradication and Recovery
• Post-Incident Activity

Ref: 800-61 NIST

I would suggest intra would be best fastest creating incident ticket.

Incident logging

Categorization and Prioritization

Escalation

Troubleshooting

Resolution

Service Restoration

Closure

Preparation->Identification->containment->eradication->recovery->lessons learnt