Incidents · Guides
Declare an incident
When something breaks, declaring it is the first thing to do: everyone who needs to know hears at once, and the timeline starts.
Declare one by hand
On Incidents' Overview, choose Declare an incident. The form asks for:
| Field | What to put |
|---|---|
| What is wrong | Short, as people will see it on a lock screen: “Checkout fails for card payments”. Up to 200 characters. |
| Summary | Optional. What you know so far: who is hit, since when. It goes out with the first notice and is shown on the incident. |
| Severity | How bad it is. SEV2 Major is chosen until you pick another. |
| It began | Optional. When it started, if before now. Empty is now. |
| Lead | Who runs it. You, until you pick someone else or Nobody yet. |
Choose Declare. The incident opens at Investigating, gets the project's next reference (INC-12) and its page opens. The project's people are told at once, and so is every chat or channel set for “An incident declared” (Tell your team).
Choose a severity
Severity says how much to drop for it. It is shown as a shape and a word everywhere, never a colour alone.
| Severity | When |
|---|---|
| SEV1 Critical | Down or losing data for many: everyone drops what they are doing. |
| SEV2 Major | A main part broken or very slow for some: worked on now. |
| SEV3 Minor | Something small or with a way around it: worked on today. |
You can change it later. Raising it while the incident is open tells everyone again; lowering it is a line on the timeline only.
Say when it began
An outage often starts before anyone declares it. Put when it really began in It began, on the clock the form names, up to 30 days back. The incident's length is counted from then, and its page asks the project's other products about the hour before it.
The page then says both: when it began, and when it was declared and how long after. A time later than now is refused.
Name a lead
The lead is one person who decides, named on the incident and in every notice. It is one of the people who open the project in Incidents. With nobody, the page says “Nobody yet”, and anyone who may run it can choose Take the lead. The lead can be handed over at any time.
Declare from what happened then
Some pages in other My Beast products ask Incidents about their moment: an error, a log line, a deploy, a downtime in Status. When no incident was open then, Incidents' answer says “No incident” and links to What happened then.
That page puts every product's answer about the stretch of time on one line, from the hour before it, and names any incident that was open then. Beside it is a short Declare form with the moment's beginning already in It began, so the incident starts when the trouble did.
You can link to it from your own tools as well:
https://services.my-beast.com/<workspace>/<project>/incidents/moment?from=2026-10-28T09:07:00Z&to=2026-10-28T09:20:00Z&title=Checkout%20is%20downfrom and to are times in ISO 8601 with a zone, at most a day apart. title fills in What is wrong, and environment names the environment the other products are asked about, production when you leave it out. A link the page can't read is said on the page.
Who can declare
People with Triage or Admin in the project for Incidents declare and run incidents. A Viewer sees every incident and changes nothing. Roles are set on the project's People page at id.
Your own systems can declare incidents too, with a server secret: see Open incidents from your systems.
Declaring always works