Section 7 · 10 min
Working an Incident Together
The incident is the shared operational record
An incident exists so that several people can respond to one situation without losing the thread. Everything you learn belongs on the incident, not in side channels.
The responder golden flow
- Notification
- Open Alert
- Assess
- Acknowledge
- Investigate
- Collaborate / Escalate
- Incident — when warranted
- Resolve
- Close
You are now at the coordinated end of the same flow.
Anatomy of an incident
You do not need to fill in every field yourself, but you should know what each part is for and where to add what you know.
Incident summary
The single plain-language statement of what is happening, readable by people who did not see the alerts.
Standard vs Major
How much coordination and communication the response needs. Major incidents pull in more people and more formal comms.
Priority / severity
How urgent the restoration work is relative to everything else in flight.
Affected service
The capability that is impacted — the anchor for impact, ownership and communications.
Responders
The people and teams formally engaged in the response, visible to everyone.
Related alerts
The technical signals that led here, kept attached so the picture stays complete.
Activity / investigation
The running record of what has been tried, ruled out and discovered.
Communications
What has been told to stakeholders, and when.
Resolution
What restored the service, captured while it is still fresh.
PIR
A post-incident review when the incident warrants structured learning.
What you do as a responder
- Add responders and teams
- Add notes as you learn things
- Keep the incident summary accurate
- Link related alerts
- Record what you have ruled out
- Record the resolution when service is restored
Key Concept 7
If it isn't on the incident, the rest of the response cannot see it.
Narrate as you go
Short notes written during the response are worth far more than a perfect write-up afterwards. They keep late joiners oriented and make the post-incident review honest.
Side channels lose context
A private chat thread or a call with no notes leaves no operational record. Bring decisions back onto the incident as soon as they are made.
Live demo
- Open an incident
- Review the summary and affected service
- Add a responder team
- Show related alerts
- Add investigation notes
- Record resolution