Work an incident
Acknowledge ownership, record investigation notes, resolve issues, and reopen when necessary.
Find or create an incident
Open Incidents to search and review the overview. Click a row to open its detail page. Public identifiers use the format INC-1000000.
To create an incident manually, use New incident, enter a title and description, choose a service and severity, and submit. The form does not include an assignee field. Monitoring systems can use the Incident API.
Understand the statuses
| Status | Meaning | Available actions |
|---|---|---|
| Triggered | The incident needs attention | Acknowledge, resolve |
| Acknowledged | Someone has taken ownership | Unacknowledge, resolve |
| Resolved | The issue is marked complete | Reopen incident |
Acknowledging from the workspace assigns the incident to the current user and records who acknowledged it and when. Unacknowledging returns it to triggered. Resolving records the resolution and a timeline entry.
Reopening returns a resolved incident to triggered and clears its current acknowledgement and resolution timestamps. Historical timeline entries remain. Reopen first if you need to acknowledge a resolved incident in the workspace.
Record the investigation
Add comments with useful observations, mitigation steps, and next actions. The activity timeline includes incident creation, monitoring updates, status changes, and comments.
Use the timeline filters, search, and sort control to find a particular update. Copy the incident link when you need to refer colleagues to the same record.
Example comment:
Confirmed connection failures from both application hosts. Restarted the connection pool at 14:10. Monitoring recovery before resolving.
Read elapsed time
The timer beside the title measures creation to the current time for an open incident, or creation to resolution for a resolved incident. It is hidden on smaller screens. Action buttons sit below the title.
On the overview, recent creation times are relative and update while the page is open. Very recent incidents show now, then minutes and hours; older dates show date and time in the organisation timezone.
Handle repeated reports
A grouped API alert adds a monitoring entry instead of creating a new incident. It does not replace the existing incident’s title, description, severity, or acknowledged state. Read Deduplication and retries to understand the grouping window.
Recommended response workflow
- Read the service and the initial report.
- Acknowledge when you take ownership.
- Record findings and mitigation in comments.
- Verify recovery using your monitoring system.
- Resolve with a final comment describing the outcome.
No outgoing notifications are sent by these actions while notification delivery is inactive.