Incident

An incident is a message representation of an alert that displays the incident's current status. The status is shown using messenger entities like emojis or color bars. Notifications and events for this incident are sent to the message thread.

Messages Structure

Incident messages have the following structure:

SlackMattermostTelegram

Templates for status icons, header and body are here. See details.

Buttons

Incidents in messengers have two mandatory buttons Take It (Release), Freeze and one optional button Task.

Take It (Release)

The button works differently depending on the incident's state.

By default, the button works as Take It. In this case it:

• stops chain escalation
• assigns (or reassigns) the incident to the user who clicked the button

The button turns into Resolved only when the incident is already associated with someone and is in the resolved status. In this case it:

• unassigns the incident
• resets the chain

Freeze

This is a time selector for choosing until when the incident will be frozen. The day and time for unfreezing are determined based on the general.week_start and general.workday_start parameters. Timezone is set for each user if available, otherwise it uses general.timezone.

Freeze behaviour (if not frozen):

• assigns the incident to the person who clicked the button (like Take It)
• stops activity on the incident (chain escalation, status updates)
• prevents creation of new incidents with the same identifier (like silence)
• displays the unfreeze datetime on the button instead of "Freeze"

Unfreeze behaviour (if frozen with button):

• sets the actual incident status
• resumes activity on the incident (chain escalation, status updates)

Task

Button without text, only pin icon: 📌. Appears only if the Task Management integration is configured.

Behaviour:

• creates a task in your Task Management software
• the button disappears

Statuses and their colors

Unlike Alertmanager alerts, IMPulse Incidents can have four statuses:

• firing
• resolved
• unknown
• closed

Incidents can also be temporarily frozen. This is a pseudo-status that hides the actual status and pauses further incident handling.

firing and resolved

Incident status changes to firing and resolved based on Alertmanager's alert statuses received by IMPulse.

unknown

IMPulse introduces an additional status called unknown to indicate that the current status of the incident may be outdated.

Alert sources use Group interval and Repeat interval to periodically resend the current alert status, even if it hasn't changed. IMPulse has a setting incident.timeouts.firing which defines how long it should wait for an update from Alertmanager. If an Incident status isn't updated within incident.timeouts.firing it switches to non-actual status named unknown.

Possible causes of unknown status:

• IMPulse did not receive an updated alert status. Possible causes:
  • the alert was silenced
  • inhibited rules configured in Alertmanager were triggered (fix it)
  • IMPulse or Alertmanager was down
  • network issues
• Repeat Interval + Group Interval in alert source less or equal IMPulse's incident.timeouts.firing

When an incident becomes unknown , IMPulse sends a warning message to messenger.admin_users↰.

closed

The closed status means the incident is closed and retained only for history and statistics. The retention period for a closed incident file is configured via incident.timeouts.closed↰. You can see closed incidents in the UI by clicking the archive button.

There are two ways an Incident can be closed: - a resolved incident remains in that status for the duration of incident.timeouts.resolved↰ - an unknown incident remains in that status for the duration of incident.timeouts.unknown↰

frozen

The frozen state is a pseudo-status that temporarily pauses incident handling and suppresses status update. When an incident is frozen, its actual status (firing, resolved, unknown, or closed) is hidden but preserved underneath. Also, while the incident is frozen, no new incident with the same identifier will be created.

An incident can be frozen two ways:

• by clicking the Freeze button and selecting a duration
• by inhibition, if the incident becomes a child

Lifecycle

IMPulse creates an Incident with the firing status and tracks it until the incident is deleted (after incident.timeouts.closed↰).

Here is a visualization of the full incident lifecycle:

Or individually by status: