> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Hub

> Deep-dive view — stages, HITL approvals, actions, and timeline

The Incident Hub (`/incidents/:id`) is the full-detail view for a single incident. Everything about an incident lives here: the current stage, agent analysis, HITL approval controls, execution logs, timeline, and collaboration tools.

## Page layout

The top of the page shows:

* **Incident title and severity badge**
* **Current stage indicator** — a horizontal stepper showing the six stages with the active one highlighted
* **Control mode badge** — Autonomous or Guided (see [Control Modes](/next/getting-started/core-concepts-control-modes))
* **Confidence dial** — the agent's current confidence in its analysis (0–100%)
* **HITL approval button** — visible only when the agent is waiting for your sign-off

Below the stage indicator, the page splits into a main content area (left) and a sidebar with the incident timeline, agent activity feed, and collaboration tools (right).

## Stage-specific sections

The main content area changes depending on which stage the incident is currently in. Each stage surfaces only the information relevant to that moment in the lifecycle.

### Detection stage

When the incident first opens, the Detection section shows:

* **Triggering Alerts** — the raw alerts that caused the incident to open, with metric values, threshold details, and timestamps
* Affected services identified from the alert payload
* Time since first detection

This section appears only during the detection stage. Once the incident advances to triage, the view changes.

### Triage stage

The triage view shows the **Impact Assessment** box:

* **Error rate** — current value
* **Latency** — current P95 value
* **Services affected** — count and list
* **Duration** — time since detection

The agent uses this data to assign severity and determine whether to escalate immediately or continue with standard triage.

### Diagnosis stage

The diagnosis view shows the agent's root-cause analysis and proposed next steps:

* **Recommendations** — a list of proposed fixes, each with a title, description, risk level, and tracker ticket link when available. Only pending (not-yet-approved) recommendations are shown here. Once a recommendation is approved and executed, it moves to the Actions Performed section.
* **Data sources** — the telemetry signals the agent queried (logs, metrics, traces, runbooks). Click any data source badge to expand the raw query and response.
* **Confidence reasoning** — the agent's explanation of what it found and how confident it is.
* **Similar problems** — previously solved problems with matching root-cause patterns.
* **Runbook citations** — runbook content the agent read during diagnosis, with links to the source.

<Note>
  Recommendations in the diagnosis stage require your approval before any action is taken. The agent will not execute anything without a human sign-off, regardless of the control mode setting.
</Note>

### Resolution stage

Once you approve a recommendation, the incident advances to resolution. The resolution view shows:

* **Execution logs** — timestamped entries for each action the agent ran, with command details and status
* **Progress** — how many of the approved fixes have been applied vs. the total
* Any partial failures or escalations, if a fix could not be fully executed

The execution log is honest: if the agent could not execute a fix, you will see an explicit "escalated to human review" entry rather than a false success.

### Verification stage

After fixes are applied, the incident moves to verification. The verification view shows a **Metric Validation table**:

| Metric      | Baseline | Current | Status    |
| ----------- | -------- | ------- | --------- |
| Error rate  | 0.12%    | 0.09%   | Recovered |
| P95 latency | 145ms    | 138ms   | Recovered |

The agent compares current metric values against the pre-incident baseline and marks each signal as Recovered, Degraded, or Unchanged. The incident advances to closure only when the agent confirms sustained recovery.

### Closure stage

The closure view shows the post-incident summary: what happened, what was done, how long it took, and any follow-up action items the agent generated.

## The HITL approval panel

When the agent is waiting for your approval, a prominent approval panel appears at the top of the main content area. The panel shows:

* The proposed action and its scope
* The agent's risk assessment (low / medium / high)
* **Approve** and **Reject** buttons
* A **Re-investigate** option — sends the incident back to the diagnosis stage so the agent runs a fresh root-cause pass before acting

<Warning>
  Approving an action is irreversible. Review the agent's full diagnosis context and data sources before deciding. If you are uncertain, click Re-investigate rather than approving under doubt.
</Warning>

## The incident timeline

The right-side timeline shows every event in the incident's history in chronological order — agent actions, stage transitions, human interventions, approval decisions, and Slack posts. Each entry has a timestamp and actor label (agent name or user email).

## Collaboration tools

The Collaboration Bar at the bottom of the page gives you quick access to:

* **SAGE chat** — open an incident-scoped chat drawer to ask SAGE questions about this specific incident. SAGE has full context: the current stage, diagnosis, execution logs, and all data sources the agent queried. See [Chat with ECHO](/next/using-sureops/chat-with-echo) for the distinction between ECHO and SAGE.
* **Slack war-room link** — deep link to the incident's dedicated Slack channel (when Slack is connected)
* **Promote to problem** — manually promote this incident to a problem record if you identify a recurring root cause

## Similar problems card

If sureops has solved incidents with a matching root-cause pattern before, a Similar Problems card appears in the sidebar. Each match shows the problem title, similarity score, and how it was resolved.

## Focus mode

To reduce distraction when working a live incident, click the focus-mode toggle in the top-right corner. This collapses the sidebar and expands the main content area to fill the screen.

## Navigating back

The back arrow at the top of the page uses smart navigation — if you arrived from the Incidents list it returns you there, and if you arrived from the Command Center it returns you to the dashboard.