Skip to content

Incidents

Auto and manual incidents, severities, status lifecycle, acknowledgement, comments, and postmortems.

opened ──▶ investigating ──▶ identified ──▶ monitoring ──▶ resolved
└──▶ reopen → monitoring
  • Opened — created. Auto or manual.
  • Investigating — default initial status. Customer-visible if you publish the incident to a status page.
  • Identified — root cause known, fix in flight.
  • Monitoring — fix deployed, watching for regressions.
  • Resolved — closed. Resolution summary is optional but encouraged; it surfaces in the postmortem.
  • Auto — the alert engine opens an incident when a rule’s condition stays matched across the configured threshold. Severity comes from the rule. Auto-resolves after N consecutive OK checks (3 by default).
  • Manual — declare from the topbar + → Declare incident. Pick severity, optionally attach affected monitors, write a title.
  • P1 — full outage, customer-impacting, all hands.
  • P2 — significant degradation; alert your on-call.
  • P3 — partial / regional issue, no immediate customer impact.
  • P4 — minor; investigate during business hours.
  • P5 — informational; no action required.

The numbers don’t enforce policy; they’re a shared vocabulary.

Press a on an incident detail page to acknowledge. Acks record who’s looking and silence subsequent alerts on the same incident. Doesn’t change status — you still drive that explicitly.

Click Resolve, or press Shift+R. The resolve dialog asks for an optional summary that’s stored on the incident and rendered into the postmortem.

Every action on an incident — status change, severity change, ack, public update, resolve — appears in the activity timeline. You can also add free-text comments (press c to focus the composer).

Visible only after resolved. Free-form Markdown. Renders inline using Pulse’s small Markdown renderer (headings, code, lists, links — no script, no embedded HTML).

From an incident’s detail page, Send public update posts to a status page tied to the incident. The update lands in the active-incident timeline on the public page. See Status pages → Linked incidents.