Skip to main content
The Incidents page (/incidents) is your full list view of every incident — open, closed, and in-progress — across your environment. You can search, filter, and drill into any incident from here.

​
What is an incident?

An incident is opened automatically when an alert fires and sureops determines it meets the threshold for agent-driven response. Each incident tracks the full lifecycle from first detection through root-cause diagnosis, fix execution, metric verification, and formal closure. Incidents are scoped to an environment. Use the context switcher in the sidebar to view incidents for a different environment.

​
Lifecycle stages

Every incident progresses through up to six stages:

​
Severity levels

The severity is set by the agent during the triage stage based on the alert payload, error rate, affected service tier, and blast radius. You can override it from the Incident Hub.

​
Status badges

Each incident in the list has a status badge showing its current stage and health:
  • Open — actively in progress
  • Resolved — fix applied and metrics verified
  • Closed — formally closed with a summary
  • Cancelled — dismissed without action (e.g., a proactive detection that self-healed)
  • Held / Flapping — agent has paused due to a pattern it treats as flapping or self-healing; will resume if the anomaly persists

​
Filtering incidents

Use the filter bar to narrow the list:
  • Status — open, resolved, closed, cancelled
  • Severity — P1 through P4
  • Stage — detection, triage, diagnosis, resolution, verification, closure
  • Search — full-text search on incident title and service name
Filters persist in the URL so you can bookmark a filtered view or share it with a team member.

​
Creating an incident manually

In most cases incidents are opened automatically by incoming alerts. You can also open an incident manually:
  1. Click New incident in the top-right of the Incidents page.
  2. Enter a title and select the environment and severity.
  3. Optionally link the incident to an affected service from your service catalog.
  4. Click Create — the Incident Commander agent picks it up immediately.
Manually created incidents follow the same lifecycle as alert-triggered ones. The difference is that the detection stage context will be minimal until the agent queries telemetry.
Click any row in the list to open the Incident Hub for that incident. The hub shows the full stage-by-stage detail view, timeline, agent analysis, and HITL approval controls.

​
Proactive detections

If proactive detection is enabled, low-confidence incidents appear in the list with a distinct badge. You can confirm or dismiss these directly from the list row, or open the Incident Hub for more detail. See Proactive Detection for how this works. To hide proactive detections from the list, toggle Hide proactive detections in the filter bar.

​
Incident to problem relationship

When an incident is closed, sureops can promote it to a problem record if it exhibits recurrence patterns or a root cause that warrants structural follow-up. The incident list shows a problem-record chip on any incident that has been linked to a problem. Click the chip to navigate to the problem record.