Timeline

Recorded events

Event	When it happens
Alert received	An alert arrived through a source and was accepted.
Incident created	The alert opened a new incident.
Alert aggregated	A new alert was attached to an already-open incident instead of duplicating it.
Notified	Notifications were dispatched to the responders.
Acknowledged	Someone acknowledged.
Assigned	The incident got an owner.
Reassigned	The owner changed.
Escalated	The incident moved to the next target.
Escalation timeout	The response window expired and triggered escalation.
Escalation exhausted	There was no next target; the owners were notified.
Fallback incident	No responder could be resolved; the owners were notified.
Resolved	Manually, or automatically by the originating tool.
Closed	Cycle finished.

How to read the timeline

Names, not identifiers. The timeline is written for humans: it records the name of the person involved.

Action source. Actions performed by people can record where they came from — web dashboard, email, Slack or Microsoft Teams.

System actions have no author. Automatic escalation and auto-resolution show up as system actions.

What it is for day to day

Shift handover

Whoever takes over on-call reads the timeline and understands the state without asking.

Time to first acknowledgement and time to resolution come straight out of the record.

Frequent escalations or recurring fallbacks point at a short schedule or a service with no team.

Who acknowledged, who took it, who resolved it — with date and time.

Older incidents may show timeline messages using legacy wording. Operational history is never rewritten — that is expected, not a bug.