What happens between down and up.
When a confirmed state change fires, an incident opens. Everything that happens next — who acknowledged, what was tried, when it recovered — lands on one timeline you can read the morning after.
Lifecycle
| Opened | Automatically, on a confirmed DOWN (or a missed heartbeat). Alerts go out per the monitor's channels or alert plan. |
| Acknowledged | Someone owns it — escalation steps stop advancing. One click in the app or POST /incidents/{id}/acknowledge. |
| Escalated | Manually pushed to the next alert-plan step when you need more hands. |
| Resolved | Automatically on confirmed recovery — recovery notices go to the same channels. Reopen if it was not actually over. |
Severities
Incidents carry a severity from your own ladder — the defaults are conventional (SEV1 downwards), but the ladder is fully yours: rename, recolor, regroup via severities and severity groups.
The timeline: comments and attachments
Comments capture what was tried; attachments hold the screenshot of the weird dashboard or the log excerpt. Months later, the timeline is the postmortem's raw material — and the answer to “how did we fix this last time?”
Playbooks
A playbook is the restart procedure that otherwise lives in a wiki nobody can find at 4 a.m. — ordered steps, attached to the monitors they belong to. When an incident opens on such a monitor, the playbook is right there, and step completion is shared: everyone sees what has already been tried, in real time. Steps tick off per incident, so the playbook itself stays clean for next time.
Reporting
Incidents feed the reporting engine — incident analytics, downtime ledgers with verifiable content hashes, SLA reports with business-hours masking. White-label PDF reports deliver on schedule; see reports in the API reference.
Via API
The full lifecycle is drivable: open, acknowledge, comment, escalate, resolve, reopen —
incidents reference. Every
transition is also a signed webhook
(incident.opened,
incident.acknowledged,
incident.resolved, …) — wire them into your own tooling
instead of polling.