Incidents · Guides
Run an incident
An incident's page says where it stands at a glance and keeps every step on its timeline. Running it is posting what you know and moving it on.
Where it stands
The head of an incident's page shows:
- the way to Resolved, each step with the time it was reached, and the next one as a button;
- its severity and its lead;
- how long it has been open, or how long it lasted;
- when the last update was posted, and the update itself.
On the side, Run it holds every change: the status, the severity, the lead, the status page, and the title and summary. Only people with Triage or Admin in the project see it.
Move it to Resolved
Every incident starts at Investigating. The statuses are:
| Status | Means |
|---|---|
| Investigating | Something is wrong; we look for why. Every incident starts here. |
| Identified | We know why; the fix is on its way. |
| Monitoring | The fix is out; we watch that it holds. |
| Resolved | Over. The write-up can be written. |
| Declined | Not an incident after all. It ends, with no write-up. |
The button in the head moves it one step on: Move to Identified, then Monitoring, then Resolve. A step can be skipped: choose any status under Run it, with a message if you like, and Change status. The head then marks the steps it went past as skipped.
Each move is a notice to your team, “Status changed” or “Resolved”, and the message goes out with it.
Post updates
The box at the end of the timeline is Post an update: what you found, what you try next, when you write again. It has two buttons:
- Post puts it on the timeline. It sends no notice, but it is the latest update on the page, and on your status page when the incident is shown there.
- Post and move to … also moves the incident to its next status, and the update goes out with that notice.
Above the box, Start from offers a first sentence for each status from here to Resolved (“We found the cause: …”). Choosing one also sets which status the second button moves to.
Keep a note internal
Tick Internal note before posting, and the update is for the project's people only: it is marked Internal on the timeline and never goes into a notice or onto the status page. Posted with a move, the note goes on the timeline and the notice goes without it.
Anything else may be read outside
Change the severity
Under Run it, pick a severity and choose Change severity. Raised while the incident is open, everyone is told again (“Severity raised”). Lowered, the timeline says so and nobody is told.
Change the lead
Pick one of the project's people, or Nobody, and choose Change lead. While an open incident has another lead or none, Take the lead in the head makes it you. Every notice names the lead at the time.
Edit the title and summary
Edit the title and summary, at the foot of Run it, changes what the incident is called. The timeline keeps the change, with the old title.
Read the timeline
The timeline is the incident's story, oldest first, on your clock. Each line says who did what: declared it, posted an update, changed the severity or status, took the lead, wrote it up. A call from your systems is marked API and named by the caller.
If the project also has other My Beast products, the timeline weaves in what they had from the hour before it began, each line with its product: Deploys, Flags, Secrets and Vulnerabilities first, as what changed just before is the first suspect, then Logs, Errors and the rest. Only this incident's hides them. You see the products you open the project in.
When a SEV1 goes quiet
People wait to hear about a SEV1. When an open SEV1 has had no update for 30 minutes, its page says so in red, with how long it has been. Post what you know, even “still looking” and when the next update comes. An internal note doesn't count: nobody outside heard it.
Reopen or decline
Declined ends an incident that wasn't one after all: it keeps its timeline and has no write-up. A resolved or declined incident can be moved back to any open status under Run it. It is then open again, and your team is told.
See every open incident
A project's Overview lists its incidents, open ones first and the worst first among them, with filters for status and severity. Open now, under All projects in Incidents' sidebar, lists the open incidents of every project you open, the worst first.
Your own systems can post updates and change the status through the API: Open incidents from your systems.