The seven statuses
What each transition means in practice
triggered → notified
triggered → notified
The incident moves to
notified when any configured channel delivers successfully — email, push, Slack, Microsoft Teams, Discord or Telegram. If no channel delivers, it stays in triggered, and that is a symptom worth investigating.→ acknowledged
→ acknowledged
The ACK is the most valuable piece of information in the flow: someone saw it and is acting. It stops automatic escalation and records who acknowledged and when.
→ assigned
→ assigned
The incident has an explicit owner. Someone took it, someone assigned it to another person, or escalation pointed at a new owner.
→ escalated
→ escalated
Nobody acknowledged in time, or someone decided to escalate. The incident gets a new owner and new notifications. See Escalation.
→ resolved
→ resolved
The problem is over. A person can mark it, or it can happen automatically when the originating tool sends the recovery event for the same alert.
→ closed
→ closed
Administrative closing, after resolution. It is the end of the cycle. It is done by a person or automatically: 5 minutes after a resolution by the integration and 1 hour after a manual resolution. See Resolve and close.
Severity
Every incident has a severity:critical, high, warning or info. It comes from the alert and determines, among other things, how push notifications behave.
See Severities.