JSMResponder Training
Alert → Incident — Section 6 of 870 / 90 min

Section 6 · 10 min

When Does an Alert Become an Incident?

Alerts are signals. Incidents are coordinated responses.

Not every alert is an incident, and treating every alert as one creates noise. 

The responder golden flow

  1. Notification
  2. Open Alert
  3. Assess
  4. Acknowledge
  5. Investigate
  6. Collaborate / Escalate
  7. Incident — when warranted
  8. Resolve
  9. Close

The distinction

Alert

A signal that something needs attention. Often resolved by a single responder.

Incident

If a Incident response is required, the OCC or Event Monitoring Team will create and Incident to coordinate the response

Signals that coordination is warranted

  • Multiple teams are needed
  • Customer impact is occurring
  • A service is degraded or unavailable
  • Coordination is required
  • Communications may be required
  • The situation is escalating

Two scenarios

Scenario A

Outcome: Alert only

  1. • CPU threshold exceeded temporarily.
  2. • Responder investigates.
  3. • Condition clears.
  4. • Alert closes.
  5. • No broader service impact.

Scenario B

Outcome: Incident

  1. • Multiple alerts indicate website video playback failure.
  2. • Customers cannot view video content.
  3. • Multiple teams are required.
  4. • Communications may be required.

ESCALATION PATH (OCC ONLY)

Alert → Assess impact → Coordination needed → Incident

  1. Alerts
  2. Incident
  3. Affected Service
  4. Responders
  5. Investigation
  6. Communications
  7. Resolution
  8. PIR when appropriate

Key Concept 6

The OCC can Escalate to an incident when restoring service needs coordination, not when the alert is merely noisy.

Watch Out

Do not over-escalate

Creating an incident for a transient condition one responder can resolve dilutes the signal for everyone. When in doubt, acknowledge, assess impact, and escalate to the OCC

Live demo

LIVE DEMO Escalate an alert into an incident
  • Open an alert with service impact
  • Assess impact
  • Create / link an incident
  • Confirm the alert stays linked
  • Add responders to the incident
Open JSM Training Environment

If you are unsure whether something warrants an incident, escalate the question rather than sitting on it. It is far cheaper to close an unnecessary incident than to discover an unmanaged outage hours later.

PreviousJira Cloud MobileNext · 10 minWorking an Incident