Incidents
Declare, assign, update, resolve, and review incidents.
Incidents are the shared record of active or resolved service disruption. They can be declared by a person, opened by a confirmed monitor failure, or ingested from an external alert provider. Open Incidents for the queue and select an incident for its full response workspace.
Lifecycle and severity
An incident moves through Investigating, Identified, Monitoring, and Resolved. Each public status update records a message and the next status. Severity is Minor, Major, or Critical. Manual declarations choose it directly; automatic incidents evaluate priority-ordered severity rules and otherwise use Major.
Monitor failures can group by matching folder and environment. Membership is deduplicated, severity can rise but not fall, and recovery waits until every affected enabled monitor has recovered. A renewed failure within 24 hours can reopen the previous incident. See Automatic incident grouping.
The Incidents page
The page shows active and resolved incidents with search, a severity filter, and Active/Resolved tabs. Each row shows severity, status, owner, age, and update count. Row actions are:
- Open incident workspace
- Copy incident ID
- Delete incident…
The Manage menu contains Work queue, Templates, Severity rules, and Alert grouping. Use Declare incident to open the declaration form: a title (up to 120 characters), an affected monitor or General incident, affected status-page components, severity, and a required initial public update. Apply a saved template if you have one.
Respond to an incident
Open the incident workspace and work through its sections.
Acknowledge and assign
Select Acknowledge incident to record that you have taken responsibility. Status records who acknowledged and when, and shows it in the response controls. Use Clear acknowledgement if ownership changes. Acknowledgement does not resolve or publish the incident, and a reopened incident must be acknowledged again.
Under Owner, choose Person or Team and a name, then select Save owner. Leave the name empty to unassign. Assignments are optional and can be changed or cleared without altering the incident status or its public updates.
Publish public updates
Use the Status and public updates card to post messages readers can see and to move the incident through its lifecycle. Each update is recorded in the public timeline. These updates may appear on status pages and reach subscribers.
Record internal notes
Use the Quick note card to record responder-only observations. Select Add to timeline; the entry is labeled internal and never appears on public surfaces.
Collaborate in the discussion
Use the Discussion card for threaded responder conversation, including
@mentions of people and teams. Discussion is internal only—it never appears
on a status page. See Comments and mentions.
Track work and evidence
Create response tasks for time-sensitive mitigation and follow-up tasks for work that survives resolution. Review Nearby deployments and classify each as suspected, contributing, unrelated, or rolled back. See Incident work.
Select affected systems
The Affected systems card lists your organization's status-page components. Select the ones this incident affects and choose Save affected systems. This decides which public pages, components, history entries, and subscriber notices include the incident. It remains editable throughout the incident's lifecycle.
The timeline
Every declaration, public update, monitor transition, assignment, acknowledgement, note, and reopen is attributed in the Complete timeline, labeled by event kind and source (operator, monitoring, system, or integration). The Status and public updates card shows only the public updates.
Delete an incident
Deleting an incident places a restorable snapshot in the recycle bin for 30 days. See Recycle bin.