Incidents

The Incidents dashboard (/incidents) gives operators a durable response workflow for grouped alerts, sessions, affected agents, containment actions, communications, and post-incident reviews.

Support status

Capability	Status	Notes
Incident list and filters	Available	Displays tenant-scoped incident records.
Create from alert/session	Available	Alert and session detail pages can open an incident with related evidence already attached.
War room timeline	Available	Timeline, notes, containment events, communication events, and review events are stored per tenant.
Bulk containment	Available	Admin-only action that records incident-scoped containment and audit entries.
Slack/email communication	Available when configured	Uses configured alert_channel integrations. Delivery failures are written to the incident timeline and do not block status transitions.
Post-incident review	Available	Manual trigger after resolved; stores root cause, impact summary, remediation, and recommendations.

Operator workflow

1. Open Incidents to filter by severity or status.
2. Create an incident from an alert, a session, or the incident list.
3. Open the war room to review timeline evidence and append notes.
4. Draft Slack or email updates from the incident context.
5. Admins can execute bulk containment for affected agents after confirmation.
6. Move the incident to resolved, then generate and export the review.

Roles

Role	Incident access
Admin	Create/update incidents, add notes, draft/send communications, execute containment, generate reviews.
Analyst	Create/update incidents, add notes, draft/send communications, generate reviews.
Viewer	Read incidents and reviews.

All incident reads and writes are scoped by tenant through X-Org-ID.