# Handle an incident

> Acknowledge an outage, bring in a colleague, post updates, work through a playbook and resolve the incident. Everything lands on one timeline.

Source: https://upfour.io/docs/handle-an-incident

Afterwards your team knows who is on an outage, what was tried and when it ended, all on one timeline you can read the next morning.

- **Who:** Any role except **Viewer**
- **Time:** A few minutes, plus the outage
- **What you need:** An incident

Viewers can read incidents but not change them. up4 opens an incident when a monitor is confirmed down or a [scheduled job](https://upfour.io/docs/watch-a-scheduled-job.md) misses its check-in. You can also declare one yourself.

**In up4:** Incidents · [Open in up4](https://app.upfour.io/incidents)

## Steps

### 1. [Open the incident or declare one](https://upfour.io/docs/handle-an-incident#open-incident)

Select the incident in the list, or follow the link in the alert you received. Unresolved incidents come first, newest on top.

To report something no monitor can see, such as a customer complaint, select **Declare incident**. Fill in **Brief description** and **In-depth description**, optionally choose an **Affected monitor (optional)**, set the **Severity** and select **Declare incident**.

To log an outage after the fact without alerting anyone, turn on **Don't notify anyone**. up4 records the incident and sends nothing through alert channels or alert plans.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-declare-form.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-declare-form.webp)

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-open-incident.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-open-incident.webp)

### 2. [Bring in a colleague if you need one](https://upfour.io/docs/handle-an-incident#escalate)

up4 has no owner field. To pull someone in, open **Manual escalation**, pick a person under **Escalate to a specific person** and select **Escalate now**. up4 shows which alert channels of that person it will use.

Do this before you acknowledge. Acknowledging stops the alert plan, and up4 cannot escalate an incident that has no running alert plan. After an escalation the plan keeps running until that person acknowledges the incident, and the timeline shows **Escalation target confirmed** when they do.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-escalate.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-escalate.webp)

### 3. [Acknowledge it](https://upfour.io/docs/handle-an-incident#acknowledge)

Select **Acknowledge**. This tells everyone that someone is on it, and the incident shows as acknowledged. Without an escalation, the alert plan stops moving on to its next step. If you escalated to a colleague, it continues until that person confirms.

Acknowledging does not fix anything and does not resolve the incident.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-acknowledge.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-acknowledge.webp)

### 4. [Write updates and work the checklist](https://upfour.io/docs/handle-an-incident#post-updates)

Write what you see and what you tried under **Post an update** and select **Post comment**. Upload logs or screenshots with **Upload** under **Attachments**.

If a [playbook](https://upfour.io/docs/write-a-playbook.md) is linked to the monitor, it appears as **Playbook checklist**. Tick a step when it is done. The ticks belong to this incident, so the next incident starts with a clean list.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-post-updates.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-post-updates.webp)

### 5. [Tell your customers](https://upfour.io/docs/handle-an-incident#tell-customers)

The incident page and a public [status page](https://upfour.io/docs/publish-a-status-page.md) are separate. Post a status report on the status page so visitors and subscribers hear it from you.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-tell-customers.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-tell-customers.webp)

### 6. [Resolve it](https://upfour.io/docs/handle-an-incident#resolve)

Select **Resolve**. up4 stops any running escalation and records who resolved it and how long it was open.

Resolved too early? Select **Reopen**, or use the undo link that appears right after resolving.

[![](https://upfour.io/docs/images/walk/en/handle-an-incident-resolve.webp)](https://upfour.io/docs/images/walk/en/handle-an-incident-resolve.webp)

## How you know it worked

The incident shows as resolved. Under **Timeline** you see every step in order: when it opened, who escalated to whom, who acknowledged it, each update, each ticked playbook step and each attachment, with the person and the time.

## Let up4 resolve it

An incident opened by a monitor resolves on its own once the monitor is confirmed back up, even if it was acknowledged. How quickly that happens depends on the monitor's recovery settings; see [when you get alerted](https://upfour.io/docs/how/when-you-get-alerted.md). A scheduled job's incident resolves when the job checks in again.

An incident you declared never resolves on its own. Someone must select **Resolve**.

## Read grouped incidents

When several monitors fail the same way, for example on timeouts, DNS errors or server errors, up4 groups their incidents. A new incident of the same kind joins an open group when it starts within 20 minutes of the group's latest incident.

Each incident keeps its own timeline. The box **CORRELATED INCIDENT** on the incident page shows the group and how many monitors are still affected. When monitors on one host fail together, a box titled Down together on example.com lists them in one place.

## Capture a screenshot of the outage

For HTTP monitors up4 can take a screenshot of the page when an incident opens. Turn it on per monitor under **Incident screenshots**, or switch on **Screenshots on by default** in your company settings and leave monitors on **Use company default**.

- up4 makes one attempt per confirmed outage, and only when the website still answered. After a timeout or a refused connection there is nothing to capture.
- The screenshot is a compact image of the visible page. It stays available for seven days on every plan. Find it under **Incident evidence** on the incident.
- A successful screenshot costs €0.005. A failed attempt is free. Team and Agency subscriptions include a monthly number of screenshots, and the line under the setting shows how many you have used.
- No screenshot is taken in the 5-minute grace mode, while monitoring is paused for billing, or after the monthly allowance is used up. The incident says why.

## If something is off

The buttons are greyed out.

Your role is Viewer. Ask an admin to change it in [team and roles](https://upfour.io/docs/team-and-roles.md).

Escalating to a colleague fails.

The person needs access to the incident and at least one alert channel of their own, and the incident needs a running alert plan. Acknowledging stops the plan, so escalate before you acknowledge. Resolved incidents cannot be escalated.

No playbook shows up.

Link a playbook to the monitor first. An incident without a monitor, and a scheduled job's incident, has no checklist.

No screenshot appears.

Check the setting on the monitor. The incident explains why it skipped one.

## What up4 does not do here

- There are three severities: Critical, Warning and Info. You choose one only when you declare an incident. You cannot rename or add levels.
- An incident has no owner or assignee. Acknowledging and escalating are how up4 records who is on it.
- Only one playbook shows on an incident, the first one linked to its monitor when sorted by title.
- Resolving a grouped incident by hand updates the group, but the other incidents in it stay open until each recovers or is resolved.
- If AI features are enabled for your Company, a resolved incident can get a drafted summary and postmortem (Evidence-aware summary and postmortem). They are not enabled for every Company.
- Incidents do not post to your status page by themselves. Status page updates are written and published separately, apart from the optional automatic reports described in [publish a status page](https://upfour.io/docs/publish-a-status-page.md).

[Per API POST /v1/incidents](https://upfour.io/docs/api/incidents#post_incidents)

Acknowledge, resolve and reopen are one request each on the incident. Comments, attachments and escalation have their own endpoints.

| In the app | API field |
| --- | --- |
| Brief description | `title` |
| In-depth description | `description` |
| Affected monitor (optional) | `monitor_id` |
| Severity · critical, warning or info | `severity` |

[Full reference](https://upfour.io/docs/api/incidents#post_incidents)

[Per API POST /v1/incidents/{incidentID}/comments](https://upfour.io/docs/api/incidents#post_incidents_incidentID_comments)

| In the app | API field |
| --- | --- |
| Post an update | `message` |

[Full reference](https://upfour.io/docs/api/incidents#post_incidents_incidentID_comments)

[Per API POST /v1/incidents/{incidentID}/escalate](https://upfour.io/docs/api/incidents#post_incidents_incidentID_escalate)

| In the app | API field |
| --- | --- |
| Escalate to a specific person · the request also needs an Idempotency-Key header | `target_user_id` |

[Full reference](https://upfour.io/docs/api/incidents#post_incidents_incidentID_escalate)

[Per API PATCH /v1/monitors/{monitorID}](https://upfour.io/docs/api/monitors#patch_monitors_monitorID)

| In the app | API field |
| --- | --- |
| Incident screenshots · a setting of the monitor, not of the incident | `capture_on_incident_open` |

[Full reference](https://upfour.io/docs/api/monitors#patch_monitors_monitorID)