IT Incident Severity Escalations

This dataset provides detailed logs of IT support incidents, capturing severity levels, escalation history, and resolution timelines. It enables organizations to analyze incident trends, monitor escalation patterns, and identify resource bottlenecks, supporting continuous improvement in IT service management.

  • last updated 12 Jul 2025
  • by GoMask
The brief that made it

Analyzing incident escalation patterns to identify process bottlenecks

Sample rows

preview · 8 of 100 rows · all 16 columns
incident_idstringseverity_levelstringescalation_countintegerlast_escalated_to_teamstringcreated_atdatetimereported_by_user_idstringassigned_teamstringincident_titlestringstatusstringlast_escalated_atdatetimeresolved_atdatetimetime_to_resolve_hoursfloatroot_causestringprioritystringincident_descriptionstringresolution_summarystring
INC100001Medium1Network Operations2024-06-01T09:18:02USR0051Desktop SupportUnable to connect to VPNResolved2024-06-01T10:15:072024-06-01T11:30:202.2Corrupted VPN profile on user device.P2User reports inability to connect to the company VPN from remote location.VPN configuration reset; user able to connect.
INC100002High2Web Development2024-06-01T08:12:33USR0044Application SupportError 500 on Payroll PortalEscalated2024-06-01T09:10:14blankblankblankP1Several users receive error 500 when accessing the payroll portal.blank
INC100003Low0blank2024-06-01T11:50:41USR0027Network OperationsIntermittent Wi-Fi in Conference Room AOpenblankblankblankblankP4Wi-Fi connectivity drops frequently in Conference Room A during meetings.blank
INC100004Medium1Cybersecurity2024-06-02T14:03:18USR0035CybersecuritySuspicious Email ReceivedIn Progress2024-06-02T14:53:12blankblankblankP3Employee received an email suspected to be a phishing attempt.blank
INC100005Low0blank2024-06-01T13:44:09USR0003Desktop SupportPrinter Offline in HRClosedblank2024-06-01T15:12:221.47Temporary network connectivity issue.P4HR department cannot print documents; printer shows offline status.Printer power cycled and reconnected to network.
INC100006Medium1Database Administration2024-06-03T09:07:11USR0047Application SupportUnable to save changes in CRMResolved2024-06-03T10:25:212024-06-03T11:31:352.4Misconfigured user permissions.P2Sales team unable to save client updates in CRM application.Database permissions adjusted; saving now possible.
INC100007High2Database Administration2024-06-04T08:36:14USR0060Database AdministrationSlow query performance in reporting DBEscalated2024-06-04T09:18:41blankblankblankP1Reports not generating on time due to slow SQL query execution.blank
INC100008Critical3Network Operations2024-06-03T16:27:32USR0012Network OperationsNo network access in WarehouseIn Progress2024-06-03T17:11:10blankblankblankP1Warehouse staff report no network connectivity in the main area.blank

What the 100 rows show

from the 100-row sample

Critical (severity level) stands out: mean escalation_count is 2.3, against 0.63 for the rest.

  • 1median escalation_count
  • 4priorities
  • 5statuses
  • 10assigned teams
  • 0.87median time_to_resolve_hours
Mean escalation_count by severity_level100 rows
0240.0Low25 rows0.53Medium36 rows1.3High29 rows2.3Critical10 rows
escalation_count100 rows, in bands of 0.5
0255045034017401.53escalation_count →

Median 1, from 0 to 3.

last_escalated_to_team55 rows with a value · 45 left blank
  1. Database Administration12
  2. Network Operations9
  3. Cloud Ops8
  4. Cybersecurity7
  5. Network Security6
  6. Application Support4
  7. Cyber Response4
  8. Field Support2
  9. Web Development1
  10. Desktop Support1
16 columns by typefrom the column list below
  • string 11
  • integer 1
  • float 1
  • datetime 3

Columns

16 columns in three groups
blueprint · 16 columns
columntypedescriptionexample
Text 11 columns
incident_idstringUnique identifier for each IT support incident.uniqueINC100001
reported_by_user_idstringIdentifier for the user who reported the incident.USR0051
assigned_teamstringName of the IT team or department assigned to resolve the incident.10 teamsDesktop Support
incident_titlestringShort title summarizing the incident.up to 150Unable to connect to VPN
incident_descriptionstringDetailed description of the incident.User reports inability to…
severity_levelstringCurrent severity level of the incident.Low · Medium · High · CriticalMedium
statusstringCurrent status of the incident.Open · In Progress · Escalated · Resolved · ClosedResolved
last_escalated_to_teamstringName of the team or department to which the incident was last escalated.11 teams · optionalNetwork Operations
resolution_summarystringSummary of how the incident was resolved.optionalVPN configuration reset; …
root_causestringIdentified root cause of the incident, if available.up to 200 · optionalFaulty monitor hardware.
prioritystringBusiness priority assigned to the incident.P1 · P2 · P3 · P4 · optionalP2
Numbers 2 columns
escalation_countintegerNumber of times the incident has been escalated.0 or more1
time_to_resolve_hoursfloatTotal time in hours taken to resolve the incident (from creation to resolution).0 or more · optional2.2
Dates and times 3 columns
created_atdatetimeTimestamp when the incident was first logged.2024-06-01T09:18:02
last_escalated_atdatetimeTimestamp of the most recent escalation event for the incident.optional2024-06-01T10:15:07
resolved_atdatetimeTimestamp when the incident was resolved.optional2024-06-01T11:30:20

Use it for

  • median escalat…1100 rowsmean escalation count…0.0Low0.53Medi…1.3High2.3Crit…

    A technology dashboard

    Escalation_count by severity_level and a breakdown of last_escalated_to_team. Excel, Power BI or Tableau.

  • Why do the 10 Critical rows have a mean escalation_count of 2.3?

    A root-cause class exercise

    Hand out the rows and one question. The answer is in the data, not in the brief.

  • A software demo

    Believable incidents with created_at, reported_by_user_id and assigned_team to fill a screen in front of a buyer.

Not quite right?

Make it yours.

Same 16 columns, your size and your rules. See 20 rows before you pay.

Preview 20 rows free

1,000 rows: $1.99 · 10,000: $12.99One-time. No subscription. All prices

This dataset100 rows16 columns
Yours1,000 rows16 columns

blueprint · it-incident-severity-escalations

Behind this dataset

Same schema. As many rows as you need.

These 100 rows came out of a blueprint — 16 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with
  • Log incident type and reported time
  • Capture severity (low, medium, high, critical)
  • Track escalation steps with timestamps
  • Flag incidents unresolved after 48 hours
  • Summarize repeat incidents by cause
Rows
Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports
CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence
yours to use, including commercially
API slug
it-incident-severity-escalations

More in Technology

Browse all
Also in TechnologyTech Support Ticket AnalyticsCustomer Support Ticket ResolutionB2B SaaS Usage RetentionAll 1,967 datasets

What should your data show?

Preview 20 rows free
No signup. No card.