Incident Details¶

The Incident Details page is a full-featured page for viewing and managing a single incident. You can view incident details, update its status, analyze related data, and collaborate with your team.

Manually Sending Webhooks¶

Members with Incident Management permissions can click Send Webhook at the top of the incident details page to immediately send the latest information of the current incident to a third-party system. This operation is available for incidents in Open, Working, Resolved, and Closed statuses.

1. In Send to, select an enabled Webhook in the current workspace.
2. Enter a sending description (1–1000 characters, supports line breaks).
3. Click Send.

Manual sending is not affected by the Webhook's automatic trigger event configuration or aggregation window. Even if an enabled Webhook has not selected any automatic trigger events, it can still be sent manually; disabled Webhooks cannot be selected. Only one Webhook can be selected at a time. No automatic retry is performed after sending, and the success or failure result can be viewed in the Send History of that Webhook.

For Webhook configuration, request protocol, and manual send payload details, see Incident Webhook Push.

Top Overview¶

The top of the incident details page displays the core information of the incident, including:

• Incident severity: e.g., P0, P1, specified when the monitor triggers, cannot be modified.
• Status and time: current status (Open/Working/Resolved/Closed) and its first trigger time, total incident duration.
• Title: brief description of the incident.
• Assignee: shows the current assignee. You can manually assign or change the assignee (member/team) here.

Status Transitions¶

• Status change: Only the current assignee can use the dropdown to change the incident status. Status changes are updated in real time and recorded in the activity timeline.
• Progress milestones: Key status change milestones are displayed as a timeline on the right side or top of the page.
• Rollback: The assignee can roll back a Working incident to Open. After rollback, the assignee is cleared.

Vacation Handling Mechanism¶

If you have claimed an incident but need to go on vacation:

1. Go to Account Settings > Status > Select "On Vacation".
2. The system will stop sending notifications for this incident to you.
3. It is recommended to hand over the incident to another user, or ensure that the escalation policy has configured a subsequent notification target.

Incident Details¶

When entering the details page, the 'Incident Details' tab is displayed by default.

Error Distribution Chart¶

Displays a bar chart of error distribution for the incident dimension over the last 1 hour. Clicking a bar navigates to the Log or Trace explorer with the current filter conditions for further analysis.

Anomaly Description¶

The Anomaly Description area concentrates the original information generated by the incident:

• Detection dimensions: Shows the detection dimensions associated with the incident, e.g., host:192.168.1.1 or service:auth, to quickly locate the affected object.
• Source: Indicates the specific monitor or intelligent inspection rule that triggered this incident, making it easy to trace the alert source.
• Event content: Shows the original alert content, usually the specific information recorded when the monitor detected the anomaly, such as the original log text or metric value.
• Detection metric: Shows the DQL query statement of the trigger condition. You can refer to this statement to understand the detection logic.
• Description: You can manually enter text here to provide additional explanation for the incident, helping the team understand.
• Additional information: Extra context added by the system or user, such as associated change records, ticket links, etc.

Operation Records¶

In the 'Operation Records' section, you can view the complete handling trace of the incident. The system clearly displays all key operations in reverse chronological order, including incident trigger, status change, severity adjustment, assignee handover, and escalation notification execution, helping you stay informed of the latest progress and trace the complete handling process.

Collaboration Records¶

You can collaborate with your team using the comment function at the bottom of the current details page, supporting text, links, or file attachments.

All collaboration content is aggregated in the Collaboration Records section. The system automatically records the complete operation log, including incident trigger, status changes, operation records, assignee adjustments, and escalation notifications, forming a clear audit trail for subsequent tracking and review.

Incident Metrics¶

You can view the periodic and cumulative data of the incident in the data section below the current details page, divided into two areas:

• Current Incident Cycle Metrics: Displays the timeline of the current cycle (Triggered / Acknowledged / Resolved / Closed) and three core metrics: MTTA (Mean Time to Acknowledge), MTTR (Mean Time to Resolve), and this duration.
• Incident Statistics Metrics: Displays the first trigger time, last trigger time, total reopen count, average MTTA, and average MTTR, accumulated from the first trigger.

After an incident is reopened, the current cycle metrics only display the latest cycle data, while the statistical metrics continue to accumulate and update.

Related Events¶

In the 'Related Events' tab of the incident details page, the system displays all monitoring events related to the incident. These events are automatically associated based on the same detection dimensions, and by default, show data from the last 2 hours before and after the incident occurred.

You can view:

• Event occurrence time, source, and specific content.
• Detection metrics and description information associated with the event.
• Event distribution (visually presented through a time bar chart).

Clicking any event or time interval in the distribution chart navigates to the corresponding analysis page with the current filter conditions, allowing you to further view detailed logs, metric trends, or trace information to help locate the root cause or assess the impact scope.

Related Data Analysis¶

Based on the incident's detection dimensions (e.g., service, host, app_name), the system automatically loads the corresponding analysis tools without manual navigation:

• If the detection dimension includes service: displays related Distributed Tracing, Service Map, Related Logs, Analysis Dashboard, etc.
• If the detection dimension includes host: displays related built-in views such as Metrics, Logs, Processes, Containers, Network, etc.
• If the detection dimension includes app_name: displays related RUM Errors, Analysis Dashboard (depending on the application type).
• Other dimensions: display the corresponding built-in views based on the actual situation.

All data views default to focusing on the last 2 hours before and after the incident occurred. You can quickly understand the impact through the distribution chart and click to navigate to the corresponding page for in-depth analysis.

Further Reading¶

You may also be interested in: