Incidents
The Incidents dashboard (/incidents) gives operators a durable response workflow for grouped alerts, sessions, affected agents, containment actions, communications, and post-incident reviews.
Status
| Capability | Status | Notes |
|---|---|---|
| Incident list and filters | Live | Reads persisted incidents from store-svc; no fixture rows are injected in production paths. |
| Create from alert/session | Live | Alert and session detail pages can open an incident with related evidence already attached. |
| War room timeline | Live | Timeline, notes, containment events, communication events, and review events are stored per tenant. |
| Bulk containment | Live | Admin-only action that records incident-scoped containment and audit entries. |
| Slack/email communication | Live | Uses configured alert_channel integrations. Delivery failures are written to the incident timeline and do not block status transitions. |
| Post-incident review | Live | Manual trigger after resolved; stores root cause, impact summary, remediation, and recommendations. |
Operator workflow
- Open Incidents to filter by severity or status.
- Create an incident from an alert, a session, or the incident list.
- Open the war room to review timeline evidence and append notes.
- Draft Slack or email updates from the incident context.
- Admins can execute bulk containment for affected agents after confirmation.
- Move the incident to
resolved, then generate and export the review.
Roles
| Role | Incident access |
|---|---|
| Admin | Create/update incidents, add notes, draft/send communications, execute containment, generate reviews. |
| Analyst | Create/update incidents, add notes, draft/send communications, generate reviews. |
| Viewer | Read incidents and reviews. |
All incident reads and writes are scoped by tenant through X-Org-ID.