Skip to content

Incident List

The Incident List is a unified page in TrueWatch for centrally managing and displaying all incidents. It is used to view, claim, and track the progress of incident handling.

By default, the list only shows incidents in the current workspace. If the current workspace has been authorized to access incident data from other workspaces, a space scope selector will appear on the left side of the search box, allowing you to filter by "Current Space" or a specified authorized workspace.

Incident List View

The list is sorted in descending order by the incident trigger time by default. Each incident displays the following core information:

  • Title: A brief description of the incident, generated by the monitor rule or manually supplemented by the handler.
  • Severity: The severity level of the incident (P0, P1, P2, P3), specified by the incident generation configuration.
  • Incident Type: Identifies how the incident was generated. Incidents generated by aggregation rules will display an Aggregated Incident label.
  • Status: The current processing stage (Open, Working, Resolved, Closed).
  • Assignee: The user or team currently claiming the incident.
  • Detection Dimensions: Tags or dimension information associated with the incident (e.g., host:web-01, service:auth), helping to quickly assess the impact scope.
  • Duration: The time elapsed since the incident was triggered.
  • Bottom Bar Information: Displays associated on-call rules and recent events (e.g., "Status changed to Working 5 minutes ago").

Filtering and Searching for Incidents

You can quickly find the target incident in various ways:

  • Quick Filter Bar: Filter by Incident Tags, Status, Severity, On-Call Rules.
  • Combined Filtering: Filter by Incident Type (aggregated incidents or monitor incidents), and by Incident Rule to filter incidents generated by specific rules.
  • Global Search: Supports keyword search for incident titles, and also supports syntax for precise matching, for example:
    • status:open: Find unhandled incidents.
    • level:p0: Find P0-level incidents.
    • assignee:Zhang San: Find incidents assigned to Zhang San.
    • tag(service):auth: Find incidents containing the tag service:auth.

Incident Claiming and Handling

Incidents can be automatically created by monitors when anomalies are detected, or created by aggregation rules that summarize events within a time window. The initial status of an incident is Open. The system will immediately notify the relevant personnel according to the configured on-call rules.

If the on-call rule enables automatic claiming and only one on-call person is matched in the on-call schedule triggered by the incident, that member will be automatically designated as the incident handler, and the incident status will be updated to Working.

  • Claiming an Incident: You can actively claim an incident on the incident list or detail page, becoming the responsible person. The status will automatically change to Working, following the principle of "claim and handle".
  • Assignee Change: For an incident in the Working status, other users can also claim it actively, and the assignee will change accordingly.

  • Status Transitions:

    • Open → Working: Automatically switched after a user claims it.
    • Working → Resolved/Closed: Manually operated by the handler, indicating the incident is resolved or closed.
    • Rollback: The handler can rollback an incident in the Working status to Open. After rollback, the assignee is cleared, and the incident re-enters the assignment process.

  • Incident Reopening: If a resolved incident is triggered again by the same monitor, the system will automatically create a new incident with the Open status.

  • Escalation Notifications: If an incident is not claimed or handled for a long time, according to the escalation policy you set, it will automatically notify more or higher-level personnel to ensure alerts are delivered.

Further Reading

You may also be interested in the following: