/incidents) is your full list view of every incident — open, closed, and in-progress — across your environment. You can search, filter, and drill into any incident from here.
What is an incident?
An incident is opened automatically when an alert fires and sureops determines it meets the threshold for agent-driven response. Each incident tracks the full lifecycle from first detection through root-cause diagnosis, fix execution, metric verification, and formal closure. Incidents are scoped to an environment. Use the context switcher in the sidebar to view incidents for a different environment.Lifecycle stages
Every incident progresses through up to six stages:Severity levels
The severity is set by the agent during the triage stage based on the alert payload, error rate, affected service tier, and blast radius. Severity is only settable at incident-creation time (for manually created incidents) or by the agent during triage — it’s read-only on the Incident Hub, with no severity-edit control there.
Status badges
The badge set differs depending on which view you’re looking at:- Active/All tab (card grid view) — each card shows an environment badge plus either a severity badge (open incidents) or a closure-reason badge (closed incidents shown here) — not both together — and a scope badge below.
- Resolved tab (list view) — each row shows a severity badge, a closure-reason badge, and a scope badge together — but no environment badge.
- Resolved by fix — an approved remediation was applied and verified
- Recovered on its own — the incident self-healed before a fix was needed
- Closed after escalation — the incident was escalated to a human and closed outside the automated flow
- Superseded — closed because it was folded into another incident
- No remaining alerts — closed because the triggering alerts cleared on their own
Filtering incidents
Use the filter bar to narrow the list:- Status — a three-way tab: All, Active, or Resolved
- Severity — P1 through P4
- Search — matches on incident title or external ID, over the incidents currently loaded on the page (not a full-text or service-name search)
There is no separate stage filter on this page — use the Status tabs and Severity filter together, or open an individual incident to see its current stage.
Creating an incident manually
In most cases incidents are opened automatically by incoming alerts. You can also open an incident manually:- Click New Incident in the top-right of the Incidents page.
- Enter a Title.
- Select the Severity and Environment.
- Optionally add a Description.
- Click Create Incident — the Incident Commander agent picks it up immediately.
Manually created incidents follow the same lifecycle as alert-triggered ones. The difference is that the detection stage context will be minimal until the agent queries telemetry.