Incident Details¶

The Incident Details page is a full-page view for centralized viewing and handling of a single incident. Here you can view incident details, manage status transitions, analyze related data, and collaborate with your team.

Warroom¶

You can create a Lark group chat from the incident details to quickly organize relevant members for collaborative incident handling. After creation, you can view, join, or share the warroom from the current page; the incident card in the group chat supports syncing the incident status and handler, as well as claiming or closing the incident.

For complete instructions on integrating an IM app and creating/managing warrooms, see Warroom.

Manual Webhook Send¶

Members with Incident Management permissions can click Send Webhook at the top of the Incident Details page to immediately send the latest information of the current incident to a third-party system. This operation is available for incidents in Open, Working, Resolved, and Closed statuses.

1. In Send to, select an enabled Webhook in the current workspace;
2. Enter a send description (1 to 1000 characters, line breaks supported);
3. Click Send.

Manual sending is not affected by the Webhook's automatic trigger event configuration or aggregation window. Even if an enabled Webhook has no automatic trigger events selected, you can still send manually; disabled Webhooks cannot be selected. Only one Webhook can be selected at a time. No automatic retry is performed after sending; the success or failure result can be viewed in that Webhook's Send History.

For Webhook configuration, request protocol, and manual send payload details, see Incident Webhook Push.

Top Summary¶

The top of the Incident Details page displays the core information of the incident, including:

• Incident Severity: e.g., P0, P1, assigned when the monitor triggers the incident; cannot be modified.
• Status & Time: Current status (Open/Working/Resolved/Closed) with its first trigger time and total incident duration.
• Title: A brief description of the incident.
• Handler: Displays the current handler. You can manually assign or change the handler (member/team) here.

Status Transitions¶

• Status Change: Only the current handler can change the incident status from the dropdown. Status changes are updated in real time and recorded in the operations timeline.
• Progress Milestones: Key status change milestones are displayed as a timeline on the right side or top of the page.
• Rollback: The handler can roll back a Working incident to Open; after rollback, the handler becomes empty.

Vacation Handling Mechanism¶

If you have claimed an incident but need to take vacation:

1. Go to Account Settings > Status > Select "On Vacation";
2. The system will no longer send you notifications for this incident;
3. It is recommended to hand off the incident to another user, or ensure that escalation policies have a subsequent notification contact configured.

Incident Details¶

When you enter the details page, the Incident Details tab is displayed by default.

Error Distribution Chart¶

Displays a bar chart of error distribution for the incident dimension over the last hour. Clicking a bar allows you to jump to the Log Explorer or Tracing Explorer with the current filter conditions for further analysis.

Anomaly Description¶

The anomaly description area consolidates the original information that triggered the incident:

• Detection Dimension: Shows the detection dimension associated with the incident, e.g., host:192.168.1.1 or service:auth, allowing quick identification of the affected objects.
• Source: Indicates the specific monitor or intelligent monitoring rule that triggered this incident, making it easy to trace the alert source.
• Event Content: Displays the original alert content, usually the specific information recorded when the monitor detected an anomaly, such as log text or metric values.
• Detection Metric: Shows the DQL query statement used to trigger the condition. You can reference this statement to understand the detection logic.
• Description: You can manually enter text here to provide additional explanation for the incident to help the team understand.
• Supplementary Information: Additional context added by the system or users, such as related change records, ticket links, etc.

Operations¶

In the Operations entry, you can view the complete handling trace of the incident. The system displays all key operations in reverse chronological order, including incident trigger, status change, severity adjustment, handler handover, and escalation notification execution, helping you stay informed of the latest progress and trace the complete handling process.

Collaboration¶

You can collaborate with your team on the current detail page using the comment function at the bottom of the page. It supports adding text, links, or uploading attachments.

All collaboration content is aggregated into the Collaboration section. The system automatically records the complete operation log, including incident trigger, status changes, operations, handler adjustments, and escalation notifications, forming a clear audit trail for subsequent tracking and post-mortem.

Incident Metrics¶

Below the current detail page, you can view the incident's periodic and cumulative data in two sections:

• Current Cycle Incident Metrics: Displays the timeline of the current cycle (triggered / acknowledged / recovered / closed) and three core metrics: Current Response Time (MTTA), Current Recovery Time (MTTR), and Current Duration.
• Incident Statistics: Displays the first trigger time, most recent trigger time, total reopen count, average MTTA, and average MTTR, accumulated from the first trigger.

After an incident is reopened, the current cycle metrics only show data for the latest cycle, while the statistics metrics continue to accumulate and update.

Related Events¶

In the Related Events tab of the Incident Details page, the system aggregates all monitoring events related to this incident. These events are automatically associated based on the same detection dimension and default to data from the last 2 hours around the incident occurrence.

You can view here:

• The occurrence time, source, and specific content of the events
• The detection metrics and description information associated with the events
• The distribution of events (visually presented via a time bar chart)

Clicking any event or a time interval in the distribution chart allows you to jump to the corresponding analysis page with the current filter conditions to further view detailed logs, metric trends, or trace information, helping you locate the root cause or assess the impact scope.

Related Data Analysis¶

Based on the incident's detection dimension (e.g., service, host, app_name), the system automatically loads the corresponding analysis tools without requiring manual navigation:

• If the detection dimension includes service: displays associated Distributed Tracing, Service Map, Related Logs, Analysis Dashboards, etc.
• If the detection dimension includes host: displays built-in views for Metrics, Logs, Processes, Containers, Network, etc.
• If the detection dimension includes app_name: displays associated RUM Errors, Analysis Dashboards (depending on the application type).
• Other dimensions: displays corresponding built-in views based on the actual situation.

All data views default to the last 2 hours around the incident occurrence. You can quickly understand the impact via the distribution chart and click to jump to the corresponding page for in-depth analysis.

Further Reading¶

You may be interested in the following: