Incidents
The incident is the unit of work. Where to read how one opens, what its page shows, how a fix is approved, verified and reviewed, and what to do when something is off.
Concept · Updated 2026-10-24 · Describes release 0.1.164
The incident path
An incident is the unit of work in this platform. Alerts arrive in volume; incidents are what a person actually opens. One opens when ingest groups the alerts that share a key, is routed to one pillar agent, investigated, handed to a person with a proposed fix, released through the approval gate, verified by a read-only recheck and recorded as a change. Read the Dashboard, Operate and alerts chapter first if you want the orientation surfaces — the Dashboard, the raw alert stream and Raise a concern. The incident page is the working surface, and it is where every decision about an incident is made, including the ones that start on Needs you.
The chapter that used to live at this address is now seven pages, one per step of that path, listed below in the order its sections had. An old link to one of its sections lands on the page that owns the section.
The pages
- How incidents work — the concepts, the six statuses and the moves between them, severity, priority and risk tier, the incident list and the compliance findings table, four use cases.
- Storms, unmapped and flapping signals — dedupe, correlation and suppression, a burst on one service, grouping by the service graph and its agent, and the intake rules for unmapped and flapping signals.
- Read an incident and its analysis — the film, the incident page top to bottom, the Probable cause card, the last-known-good record, reading an RCA and asking a follow-up.
- Approve and run a fix — every action and its permission, reviewing and applying a fix, the approval gate in both postures, and the Needs you page.
- Review execution in Changes — the change request, changes captured from your cloud audit log, the compliance check a change triggered, and suppressing a flagged resource.
- Verify recovery — the recheck, post-fix validation and post-close verification, and what each verdict does.
- Troubleshoot incidents — symptoms and fixes, limits and gotchas, permissions at a glance.