# Incidents An **incident** is a problem that your team works on together. It has a status, a severity, updates, roles, a timeline and a postmortem. Alerts tell you that something is wrong. An incident is where your team handles it, and where you tell your customers about it on a [status page](/status-pages/incidents). ## Incidents and alerts | | [Alert](/alerting/alerts) | Incident | |---|---|---| | Starts | Automatically, when a monitor, host, domain or alert source sees a problem | When a person, an escalation path, the API or an AI assistant declares it | | Ends | When the source recovers, or someone resolves it | When someone resolves it | | Statuses | `firing`, `resolved` | `investigating`, `identified`, `monitoring`, `resolved` | | Has | An escalation path and notifications | Updates, roles, a timeline, a postmortem, a Slack channel | An incident can come from an alert, but it does not have to. Resolving an incident does not resolve its alert. The alert resolves when its source recovers. ## Declare an incident 1. In the dashboard, select **Incidents**. 2. Select **Declare incident**. 3. Enter a **Title**: the symptom, for example `Checkout API returning 502s in eu-west`. 4. Select a severity. The default is `medium`. 5. Optional: enter a **Summary** with the impact and links. 6. Select **Declare incident**. The incident starts in the `investigating` status. You land on the incident page, where you can assign roles and post the first update. You can also declare an incident in these places: - In Slack, with `/spectate declare`, the **Declare incident** shortcut, or the **Declare incident** button on an alert message. See [Slack](/alerting/slack). - In an [escalation path](/alerting/escalation-paths), with a **Create incident** step. The incident gets the alert's title and severity. An alert opens one incident at most. - With the [public API](/api-reference/incidents): `POST /v1/incidents` with `title`, `severity` and an optional `summary`. - With an AI assistant through the [MCP server](/developers/mcp). If Slack is connected, each new incident can get its own Slack channel. See [incident channels](/alerting/slack#incident-channels). ## The reference Each incident gets a number in your team: the first is `INC-1`, the next `INC-2`, and so on. Spectate shows the reference in the dashboard, in Slack and in incident channel names. ## Statuses | Status | Meaning | |---|---| | `investigating` | Declared. The cause is not known yet. | | `identified` | The cause is known and someone works on it. | | `monitoring` | A fix is out. The team watches whether it holds. | | `resolved` | The incident is over. | Move the incident through the statuses with updates. See [updates and roles](/incidents/updates-and-roles). ## Severity An incident has the same four severities as an alert: | Severity | Use | |---|---| | `critical` | Customers are affected right now. | | `high` | Serious, needs attention soon. | | `medium` | Should be looked at. | | `low` | Informational. | ## Edit an incident You can change the title, the summary and the severity of an incident at any time, also after you resolve it. 1. Open the incident. 2. Select **Edit**. 3. Change the **Title**, the **Severity** or the **Summary**. The summary is Markdown. 4. Select **Save changes**. Spectate records the change on the incident timeline with your name. If the incident has a Slack channel, Spectate posts the change there. A severity change shows the old and the new severity. You can also edit an incident with the [public API](/api-reference/incidents) (`PATCH /v1/incidents/{incident}`) or with an AI assistant through the MCP server. To change the status, post an update. See [updates and roles](/incidents/updates-and-roles). ## Acknowledge an incident Acknowledge an incident to show that someone works on it. 1. Open the incident. 2. Select **Acknowledge**. The incident moves to `identified`. If an alert opened the incident, Spectate also acknowledges that alert, which stops its escalation. You can also acknowledge in Slack, with `/spectate ack` or the **Acknowledge** button in the incident channel. ## Resolve an incident 1. Open the incident. 2. Select **Resolve**. The incident moves to `resolved`. In Slack, with the API and with the MCP server, you can add a closing message, which Spectate posts as the last update. After you resolve the incident, write the [postmortem](/incidents/postmortems). ## Delete an incident 1. Open the incident. 2. Select **Delete**. 3. Type the reference, for example `INC-42`, to confirm. 4. Select **Delete incident**. Spectate deletes the incident with its updates, roles and postmortem. This cannot be undone. The alert that opened the incident does not change. Status page incidents that you published from it stay on their status pages. The Slack channel of the incident stays in Slack. ## Notifications Spectate does not send emails about incidents. It tells people in these places: - Slack: the announcements channel and the incident channel, if you [connected Slack](/alerting/slack). - Status pages: only when you publish an update. See [updates and roles](/incidents/updates-and-roles#publish-to-a-status-page). ## Find incidents The **Incidents** page has the tabs **Active**, **Investigating**, **Identified**, **Monitoring**, **Resolved** and **All**. You can search by title and filter by severity. ## Who can do what | Action | Owner | Manager | Admin | Member | Billing | |---|---|---|---|---|---| | See incidents | Yes | Yes | Yes | Yes | No | | Declare, edit, update, acknowledge and resolve | Yes | Yes | Yes | Yes | No | | Publish to a status page | Yes | Yes | Yes | No | No | | Delete | Yes | Yes | Yes | No | No | ## Related Post updates, assign a commander and publish to status pages. Write down what happened and what changes.