JSMResponder Training
Alert → Incident — Section 6 of 870 / 90 min

Section 6 · 10 min

When Does an Alert Become an Incident?

Alerts are signals. Incidents are coordinated responses.

Not every alert is an incident, and treating every alert as one creates noise. 

The responder golden flow

  1. Notification
  2. Open Alert
  3. Assess
  4. Acknowledge
  5. Investigate
  6. Collaborate / Escalate
  7. Incident — when warranted
  8. Resolve
  9. Close

The distinction

Alert

A signal that something needs attention. Often resolved by a single responder.

Incident

A coordinated response to a situation affecting service, requiring shared ownership and often communication.

Signals that coordination is warranted

  • Multiple teams are needed
  • Customer impact is occurring
  • A service is degraded or unavailable
  • Coordination is required
  • Communications may be required
  • The situation is escalating

Two scenarios

Scenario A

Outcome: Alert only

  1. • CPU threshold exceeded temporarily.
  2. • Responder investigates.
  3. • Condition clears.
  4. • Alert closes.
  5. • No broader service impact.

Scenario B

Outcome: Incident

  1. • Multiple alerts indicate website video playback failure.
  2. • Customers cannot view video content.
  3. • Multiple teams are required.
  4. • Communications may be required.

Escalation path

Alert → Assess impact → Coordination needed → Incident

  1. Alerts
  2. Incident
  3. Affected Service
  4. Responders
  5. Investigation
  6. Communications
  7. Resolution
  8. PIR when appropriate

Key Concept 6

Escalate to an incident when restoring service needs coordination, not when the alert is merely noisy.

Watch Out

Do not over-escalate

Creating an incident for a transient condition one responder can resolve dilutes the signal for everyone. When in doubt, acknowledge, assess impact, and escalate deliberately.

Live demo

LIVE DEMO Escalate an alert into an incident
  • Open an alert with service impact
  • Assess impact
  • Create / link an incident
  • Confirm the alert stays linked
  • Add responders to the incident
Open JSM Training Environment

If you are unsure whether something warrants an incident, escalate the question rather than sitting on it. It is far cheaper to close an unnecessary incident than to discover an unmanaged outage hours later.

PreviousJira Cloud MobileNext · 10 minWorking an Incident