Copy page

Incidents

Updates and roles

During an incident, your team posts updates to say what is known and what happens next. Each update can move the incident to its next status. Roles say who leads the response and who talks to customers. When customers need to know, publish an update to a status page.

Post an update

1. Open the incident.
2. Under Status for the next update, select a stage if the status changes.
3. In the Post update panel, write the update in Markdown.
4. Select Post update, or Post & mark identified (or the stage you selected).

Updates are internal. Your team sees them on the incident timeline, and in the Slack incident channel. Customers do not see them. To tell customers, publish to a status page.

With the public API, send POST /v1/incidents/{incident}/updates with a body and an optional status. In Slack, use /spectate update.

An update does not change the title, the summary or the severity. To change them, select Edit on the incident. See edit an incident.

Statuses

An incident moves through these statuses:

1. investigating: declared, the cause is not known yet.
2. identified: the cause is known and someone works on it.
3. monitoring: a fix is out, and the team watches whether it holds.
4. resolved: over.

You can skip a status. Acknowledging an incident moves it to identified. See incidents for acknowledging and resolving.

Roles

Each role has one person at a time. The person must be a member of the team.

Assign a role

1. Open the incident.
2. In the Roles panel, select Assign next to the role, or Change if someone has it.
3. Under Member, select a team member.
4. Select Assign role.

The new person replaces whoever had the role. To clear a role, select Remove. In Slack, use /spectate roles or the Roles button in the incident channel.

Timeline

The Timeline panel shows everything that happened, newest first:

• The declaration, and whether a person or an escalation path declared it.
• Updates, with their author and status.
• Acknowledgement and resolution.
• Status and severity changes, and edits to the title or summary.
• Role assignments.

Select Updates to see only the updates, or All to see everything. Spectate records who did each thing: a member, or the name of the API token. The public API returns the same entries at GET /v1/incidents/{incident}/timeline.

Publish to a status page

Publish an update to tell customers about the incident on a status page. The first update creates the public incident on that page. Later updates go to the same public incident.

1. Open the incident.
2. In the Status pages panel, select Publish, or Update next to a status page.
3. Select the Status page.
4. Select the Public status.
5. Select the Impact on each affected component.
6. Write the Subscriber-facing update.
7. Optional: change Happened at, if the update describes an earlier moment.
8. Keep Notify subscribers by email selected to email subscribers, or clear it.
9. Select Publish update.

Owners, managers and admins can publish to a status page. Members can post internal updates, but cannot publish. In Slack, use /spectate status-page. With the API, send POST /v1/incidents/{incident}/status-page-updates.

Slack incident channel

If you connected Slack, Spectate posts each update, status change, severity change, role change and status page update into the incident's Slack channel. It also posts edits of the title or summary. Things that people do in the channel show on the incident in the dashboard, with the right person. To add a Slack message to the timeline, react to it with the pushpin emoji. See incident channels.

Related

• Postmortems: write down what happened after the incident.
• Status page incidents: how public incidents look to customers.