> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Incidents

> Viewing, filtering, and managing incidents in sureops

The Incidents page (`/incidents`) is your full list view of every incident — open, closed, and in-progress — across your environment. You can search, filter, and drill into any incident from here.

## What is an incident?

An incident is opened automatically when an alert fires and sureops determines it meets the threshold for agent-driven response. Each incident tracks the full lifecycle from first detection through root-cause diagnosis, fix execution, metric verification, and formal closure.

Incidents are scoped to an environment. Use the context switcher in the sidebar to view incidents for a different environment.

## Lifecycle stages

Every incident progresses through up to six stages:

| Stage            | What happens                                                                         |
| ---------------- | ------------------------------------------------------------------------------------ |
| **Detection**    | Alert received; incident created; initial context gathered                           |
| **Triage**       | Severity assigned; impact assessed; affected services identified                     |
| **Diagnosis**    | Root cause analysis; agent queries telemetry and runbooks; recommendations generated |
| **Resolution**   | Approved fix executed; agent monitors for recovery signals                           |
| **Verification** | Metrics compared against baseline to confirm recovery                                |
| **Closure**      | Incident formally closed; post-incident summary written                              |

## Severity levels

| Severity | Meaning                             |
| -------- | ----------------------------------- |
| **P1**   | Customer-impacting; all hands       |
| **P2**   | High priority; prioritized response |
| **P3**   | Standard response                   |
| **P4**   | Low priority; informational         |

The severity is set by the agent during the triage stage based on the alert payload, error rate, affected service tier, and blast radius. You can override it from the Incident Hub.

## Status badges

Each incident in the list has a status badge showing its current stage and health:

* **Open** — actively in progress
* **Resolved** — fix applied and metrics verified
* **Closed** — formally closed with a summary
* **Cancelled** — dismissed without action (e.g., a proactive detection that self-healed)
* **Held / Flapping** — agent has paused due to a pattern it treats as flapping or self-healing; will resume if the anomaly persists

## Filtering incidents

Use the filter bar to narrow the list:

* **Status** — open, resolved, closed, cancelled
* **Severity** — P1 through P4
* **Stage** — detection, triage, diagnosis, resolution, verification, closure
* **Search** — full-text search on incident title and service name

Filters persist in the URL so you can bookmark a filtered view or share it with a team member.

## Creating an incident manually

In most cases incidents are opened automatically by incoming alerts. You can also open an incident manually:

1. Click **New incident** in the top-right of the Incidents page.
2. Enter a title and select the environment and severity.
3. Optionally link the incident to an affected service from your service catalog.
4. Click **Create** — the Incident Commander agent picks it up immediately.

<Note>
  Manually created incidents follow the same lifecycle as alert-triggered ones. The difference is that the detection stage context will be minimal until the agent queries telemetry.
</Note>

## Navigating to an incident

Click any row in the list to open the [Incident Hub](/next/using-sureops/incident-hub) for that incident. The hub shows the full stage-by-stage detail view, timeline, agent analysis, and HITL approval controls.

## Proactive detections

If proactive detection is enabled, low-confidence incidents appear in the list with a distinct badge. You can confirm or dismiss these directly from the list row, or open the Incident Hub for more detail. See [Proactive Detection](/next/onboarding/proactive-detection) for how this works.

To hide proactive detections from the list, toggle **Hide proactive detections** in the filter bar.

## Incident to problem relationship

When an incident is closed, sureops can promote it to a problem record if it exhibits recurrence patterns or a root cause that warrants structural follow-up. The incident list shows a problem-record chip on any incident that has been linked to a problem. Click the chip to navigate to the problem record.