Skip to content

Incident Lifecycle

Incidents move through configurable statuses so teams share a single source of truth from detection to closure.

Typical lifecycle

Section titled “Typical lifecycle”
New → Acknowledged → Investigating → Mitigation in Progress → Resolved → Closed

Your tenant may also use states such as Escalated, Waiting for Vendor, or Waiting for Maintenance Window, depending on ITSM settings.

Working an incident

Section titled “Working an incident”

On the incident detail page (/incidents/:id):

  • Update status via allowed transitions (enforced by tenant workflow rules)
  • Use the timeline for notes and system events
  • Manage assignees and linked assets
  • Open related changes, problems, or post-incident reviews from cross-links when permitted

SLA

Section titled “SLA”

SLA timers depend on policies configured under Settings. Approaching breach may surface flags and notifications to assigned users.

Section titled “Related records”
ActionPurpose
Create ChangeControlled remediation in production
Create ProblemTrack recurring root cause
Post-incident reviewFormal lessons learned after major events
Link VulnerabilityTie to known CVEs

Permissions

Section titled “Permissions”
  • incidents.read — view
  • incidents.update — edit fields and transition where allowed
  • incidents.create — new incidents

See also

Section titled “See also”