Copy page

Incidents

Incidents

An incident is a problem that your team works on together. It has a status, a severity, updates, roles, a timeline and a postmortem. Alerts tell you that something is wrong. An incident is where your team handles it, and where you tell your customers about it on a status page.

Incidents and alerts

An incident can come from an alert, but it does not have to. Resolving an incident does not resolve its alert. The alert resolves when its source recovers.

Declare an incident

1. In the dashboard, select Incidents.
2. Select Declare incident.
3. Enter a Title: the symptom, for example Checkout API returning 502s in eu-west.
4. Select a severity. The default is medium.
5. Optional: enter a Summary with the impact and links.
6. Select Declare incident.

The incident starts in the investigating status. You land on the incident page, where you can assign roles and post the first update.

You can also declare an incident in these places:

• In Slack, with /spectate declare, the Declare incident shortcut, or the Declare incident button on an alert message. See Slack.
• In an escalation path, with a Create incident step. The incident gets the alert's title and severity. An alert opens one incident at most.
• With the public API: POST /v1/incidents with title, severity and an optional summary.
• With an AI assistant through the MCP server.

If Slack is connected, each new incident can get its own Slack channel. See incident channels.

The reference

Each incident gets a number in your team: the first is INC-1, the next INC-2, and so on. Spectate shows the reference in the dashboard, in Slack and in incident channel names.

Statuses

Move the incident through the statuses with updates. See updates and roles.

Severity

An incident has the same four severities as an alert:

Edit an incident

You can change the title, the summary and the severity of an incident at any time, also after you resolve it.

1. Open the incident.
2. Select Edit.
3. Change the Title, the Severity or the Summary. The summary is Markdown.
4. Select Save changes.

Spectate records the change on the incident timeline with your name. If the incident has a Slack channel, Spectate posts the change there. A severity change shows the old and the new severity.

You can also edit an incident with the public API (PATCH /v1/incidents/{incident}) or with an AI assistant through the MCP server. To change the status, post an update. See updates and roles.

Acknowledge an incident

Acknowledge an incident to show that someone works on it.

1. Open the incident.
2. Select Acknowledge.

The incident moves to identified. If an alert opened the incident, Spectate also acknowledges that alert, which stops its escalation. You can also acknowledge in Slack, with /spectate ack or the Acknowledge button in the incident channel.

Resolve an incident

1. Open the incident.
2. Select Resolve.

The incident moves to resolved. In Slack, with the API and with the MCP server, you can add a closing message, which Spectate posts as the last update. After you resolve the incident, write the postmortem.

Delete an incident

1. Open the incident.
2. Select Delete.
3. Type the reference, for example INC-42, to confirm.
4. Select Delete incident.

Spectate deletes the incident with its updates, roles and postmortem. This cannot be undone. The alert that opened the incident does not change. Status page incidents that you published from it stay on their status pages. The Slack channel of the incident stays in Slack.

Notifications

Spectate does not send emails about incidents. It tells people in these places:

• Slack: the announcements channel and the incident channel, if you connected Slack.
• Status pages: only when you publish an update. See updates and roles.

Find incidents

The Incidents page has the tabs Active, Investigating, Identified, Monitoring, Resolved and All. You can search by title and filter by severity.

Who can do what

Related