Incidents

An incident is a problem that reaches many people at once: checkout is down, emails don't arrive, a release broke logging in. Instead of answering every case about it separately, you declare an incident, link the cases it causes, and follow it from New to Closed with one person leading the response. You can update every requester at once (and, with the Status Page plugin, a status page on your portal), and write a review afterwards. It follows common incident-management practice: priority from impact and urgency, targets, holds, resolution codes.

Incidents come with the Incident Management plugin, built on Service Configuration. If you don't see Incident Management under Plugins in the sidebar, the plugin is off; an admin turns it on under Settings → Plugins (which turns on Service Configuration with it).

Who can use it

Needs the Incident Management plugin, built on Service Configuration.

Who	Can
Agent	Read incidents and work on them: declare, change status, commander, category and units, add notes, link cases, write the review.
Incident Responder	The same, and run major incidents (with Major Incident Management).
Incident Manager	Everything about incidents: also delete them, change the settings, declare major incidents and publish on the status page.
Viewer, Auditor	Read incidents.
Administrator	Everything.

Everyone sees only the incidents that affect the units they work in. Each permission in detail: Who may do what.

The Incidents page

Open Incident Management in the sidebar. The red number next to it is how many incidents are open (not resolved or closed) that you can see.

The page lists the open incidents (not resolved or closed), most urgent first, in a list built for hundreds of them, like the inbox's cases and laid out the same way. Each row shows the priority, the title with the key (INC-1, INC-2 … per organization), the category and how many linked cases you can see, and by default the status, the commander (or No commander), the Requester (of the case it was declared from, or the first linked case), the Account of its linked cases ("Gizmo +2" when there are more), the affected units, when it must be resolved (the time left, Missed or Paused while on hold), and how long it has been going. P1 and P2 rows have a red or amber edge. Columns picks your own, from everything an incident has (impact, urgency, category, every account, when it was detected, resolved, created and updated, whether it is on the status page); see your columns.

• Search finds words in the title or summary, or a key like INC-12. / jumps to it.
• Filters: Status (one open status, Resolved and closed, or Any status; open by default), Priority (one, or P1–P2), Commander (Me, Nobody or a person), Unit (and the units below it), Account (incidents with a linked case from that company), Created and Updated (within the last 24 hours, 7, 30 or 90 days), Service (on the service or one of its offerings), and Category (with its subcategories). Clear filters removes them all.
• At a glance, above the list: how many of the incidents the filters select missed a target, are P1–P2, have no commander, are led by me, and are on hold. Click a chip to show only those; click again to clear it.
• Sorting: most urgent (the default), newest, resolve target soonest, or recently updated; the Resolve by and Started headings sort too. Resolved and closed incidents show how long they lasted and when they were resolved.
• Pages: 25, 50, 100 or 500 rows at a time (the browser remembers), with the total at the bottom.
• Comfortable or compact: the switch at the right of the filters. Compact shows one line per incident; the inbox uses the same setting.
• Keyboard: j and k (or the arrow keys) move through the list, Enter or o opens, Esc lets go.
• Selecting incidents: with Problem Management on, point at the start of a row and tick the box that appears. A bar shows at the bottom with the number selected; Link to problem links them all to an existing problem, or opens a New problem instead with every one of them linked.
• Export: the Export menu downloads the incidents the filters select, with the columns shown, as Excel, CSV or PDF. Each file says who exported it, when, with which filters, and carries a checksum (exports).

The address keeps the filters, the sort and the page, so you can share them and come back to the same place.

You see an incident when you can see at least one of its affected units, like cases. Affected units you can't see are only counted ("and 1 more"). Admins see every incident.

In this section

• Priority and targets: How priority is set, and the response and resolve targets.
• Declaring an incident: From a case, the Incidents page or the API.
• The incident page: Status, timeline, linked cases, the review and controls.
• Linked cases and updates: Linking cases, and updating every requester at once.
• Permissions and the API: Each permission in detail, and what AI assistants and the API can do.