Creating your first incident

Creating your first incident

Let's run a quick incident to check we've got everything wired up correctly.

There's a lot you can do with incident.io so we won't cover everything in depth, but you can read more about what's possible in our Getting Started guide.

💡

In this guide we're running a fictional incident, but if you have a recent incident you can re-run using incident.io to see where and how it might have been able to help, even better!

1. Create an incident

Create a incident with /incident Oh no!. For now we just want some basic incident automation so we won't put anything in the modal that pops up. Instead we'll just click "Submit".

This will do a number of things, including creating a new channel specific to this incident and making an internal incident homepage available. If we head into the incident channel, we'll see a few options presented to us right away.

image
image

2. Assign yourself as the lead

You can do this with the quick action, or manually with /incident lead me (or /incident lead @person if you're not going to be leading the incident).

image

3. Provide an initial summary

You can use the quick action on the initial incident message, or you can type /incident summary. Let's provide a quick insight into what's happening for the benefit of those who join the incident later. We'll see it reflected in the post in the announcement channel, on the incident homepage, and in our timeline, too.

4. Rename the incident

Now we know a bit more about what's going on, let's rename the incident, which will give our channel a more descriptive name and update the title on the incident homepage.

image

5. Update the severity

Let's pretend this incident just heated up a little and adjust the severity. We'll see a bunch of things happen automatically, ensuring that the severity is reflected everywhere the incident is show.

image

6. Update the incident status

Imagine we've got a good idea of what's causing the issue, let's progress the incident status to fixing with /incident status fixing.

image

7. Pin some key messages for the timeline

Although we automatically note many events on your timeline, you can manually note them, too. Simply use Slack's "pinning"

Pinned messages in slack...
Pinned messages in slack...
... will appear in the timeline
... will appear in the timeline

7. Close the incident

Let's imagine the incident is now over, we've monitored our fix and we're confident we're ready to move into the post-incident followup stage. We'll close the incident with /incident close, which will ask us to quickly review the current information and then move the incident into a closed state.

8. Export a postmortem

Once an incident has been closed, you'll often want to run a postmortem.

Rather than going through reams of information and trying to pull together a narrative of what happened, we can generate you something automatically.

image

9. Export followup actions