Skip to main content
The Incident Hub (/incidents/:id) is the full-detail view for a single incident. Everything about an incident lives here: the current stage, agent analysis, HITL approval controls, execution logs, timeline, and collaboration tools.

​
Page layout

The top of the page shows:
  • Incident title and severity badge
  • Current stage indicator — a horizontal stepper showing the six stages with the active one highlighted
  • Control mode badge — Autonomous or Guided (see Control Modes)
  • Confidence dial — the agent’s current confidence in its analysis (0–100%)
  • HITL approval button — visible only when the agent is waiting for your sign-off
Below the stage indicator, the page splits into a main content area (left) and a sidebar with the incident timeline, agent activity feed, and collaboration tools (right).

​
Stage-specific sections

The main content area changes depending on which stage the incident is currently in. Each stage surfaces only the information relevant to that moment in the lifecycle.

​
Detection stage

When the incident first opens, the Detection section shows:
  • Triggering Alerts — the raw alerts that caused the incident to open, with metric values, threshold details, and timestamps
  • Affected services identified from the alert payload
  • Time since first detection
This section appears only during the detection stage. Once the incident advances to triage, the view changes.

​
Triage stage

The triage view shows the Impact Assessment box:
  • Error rate — current value
  • Latency — current P95 value
  • Services affected — count and list
  • Duration — time since detection
The agent uses this data to assign severity and determine whether to escalate immediately or continue with standard triage.

​
Diagnosis stage

The diagnosis view shows the agent’s root-cause analysis and proposed next steps:
  • Recommendations — a list of proposed fixes, each with a title, description, risk level, and tracker ticket link when available. Only pending (not-yet-approved) recommendations are shown here. Once a recommendation is approved and executed, it moves to the Actions Performed section.
  • Data sources — the telemetry signals the agent queried (logs, metrics, traces, runbooks). Click any data source badge to expand the raw query and response.
  • Confidence reasoning — the agent’s explanation of what it found and how confident it is.
  • Similar problems — previously solved problems with matching root-cause patterns.
  • Runbook citations — runbook content the agent read during diagnosis, with links to the source.
Recommendations in the diagnosis stage require your approval before any action is taken. The agent will not execute anything without a human sign-off, regardless of the control mode setting.

​
Resolution stage

Once you approve a recommendation, the incident advances to resolution. The resolution view shows:
  • Execution logs — timestamped entries for each action the agent ran, with command details and status
  • Progress — how many of the approved fixes have been applied vs. the total
  • Any partial failures or escalations, if a fix could not be fully executed
The execution log is honest: if the agent could not execute a fix, you will see an explicit “escalated to human review” entry rather than a false success.

​
Verification stage

After fixes are applied, the incident moves to verification. The verification view shows a Metric Validation table: The agent compares current metric values against the pre-incident baseline and marks each signal as Recovered, Degraded, or Unchanged. The incident advances to closure only when the agent confirms sustained recovery.

​
Closure stage

The closure view shows the post-incident summary: what happened, what was done, how long it took, and any follow-up action items the agent generated.

​
The HITL approval panel

When the agent is waiting for your approval, a prominent approval panel appears at the top of the main content area. The panel shows:
  • The proposed action and its scope
  • The agent’s risk assessment (low / medium / high)
  • Approve and Reject buttons
  • A Re-investigate option — sends the incident back to the diagnosis stage so the agent runs a fresh root-cause pass before acting
Approving an action is irreversible. Review the agent’s full diagnosis context and data sources before deciding. If you are uncertain, click Re-investigate rather than approving under doubt.

​
The incident timeline

The right-side timeline shows every event in the incident’s history in chronological order — agent actions, stage transitions, human interventions, approval decisions, and Slack posts. Each entry has a timestamp and actor label (agent name or user email).

​
Collaboration tools

The Collaboration Bar at the bottom of the page gives you quick access to:
  • SAGE chat — open an incident-scoped chat drawer to ask SAGE questions about this specific incident. SAGE has full context: the current stage, diagnosis, execution logs, and all data sources the agent queried. See Chat with ECHO for the distinction between ECHO and SAGE.
  • Slack war-room link — deep link to the incident’s dedicated Slack channel (when Slack is connected)
  • Promote to problem — manually promote this incident to a problem record if you identify a recurring root cause

​
Similar problems card

If sureops has solved incidents with a matching root-cause pattern before, a Similar Problems card appears in the sidebar. Each match shows the problem title, similarity score, and how it was resolved.

​
Focus mode

To reduce distraction when working a live incident, click the focus-mode toggle in the top-right corner. This collapses the sidebar and expands the main content area to fill the screen. The back arrow at the top of the page uses smart navigation — if you arrived from the Incidents list it returns you there, and if you arrived from the Command Center it returns you to the dashboard.