Incident response

Step by step

1. Observe service Monitoring Operator

   The Monitoring Operator reviews a failed availability check and recent resource samples for the affected service and asset.

   • Preserve check and sample times
   • Updates Availability checks, Server samples

2. Open incident Monitoring Operator

   The operator records a summary, priority, service, asset and assignee, then leaves the incident open for the named responder.

   • Identify affected service and owner
   • Updates Incidents, Services, Assets

3. Acknowledge Incident Responder

   The Incident Responder accepts the case, records the acknowledgment time and a response event, and changes the incident state to acknowledged.

   • Record the receiving responder
   • Updates Incidents, Response events

4. Investigate Incident Responder

   The responder enters an attributed update describing the evidence, the action taken and what remains uncertain. Further response events mark escalation or mitigation.

   • Build the attributed chronology
   • Updates Incident updates, Response events

5. Resolve Incident Responder

   Once the service result is checked, the responder records a resolution event and time. The Service Owner reviews the history before closure.

   • Preserve recovery time and action
   • Updates Incidents, Response events

Monitoring Operator

Opens and routes the case; Incident Responder owns investigation; Service Owner reviews the outcome.