An incident is any unplanned event that degrades or interrupts a service: an API returning errors, a checkout page that won't load, a database running out of connections. Incident management gives everyone a shared playbook for those moments: who gets paged, who is in charge, how updates are shared and what happens afterwards. Without one, people duplicate work, customers hear nothing, and the same failure comes back next month.
The incident lifecycle
- Detect. A monitoring alert, a failed uptime check or a customer report flags a problem.
- Triage. Someone confirms the impact and assigns a severity.
- Respond. The on-call engineer is paged. For severe incidents, one person takes the incident commander role and coordinates, while others investigate and one handles communication.
- Mitigate, then resolve. Restore service first, by rolling back, failing over or scaling up. Fix the underlying cause after users are no longer affected.
- Communicate. Update stakeholders and customers at a regular cadence, even when there is no news.
- Learn. A blameless postmortem records the timeline, the causes and follow-up actions, and someone owns each action.
Severity levels
Definitions vary by company. What matters is that everyone uses the same ones. A common scheme:
| Severity | Example | Typical response |
|---|---|---|
| SEV1 | Site or core feature down for all users, data loss, security breach | Page immediately, incident commander assigned, frequent public updates |
| SEV2 | Major feature broken or badly degraded for some users | Page on-call, regular updates |
| SEV3 | Minor problem with a workaround | Fix during working hours |
Metrics to track
- MTTD (mean time to detect): how long a problem exists before anyone knows.
- MTTA (mean time to acknowledge): how long an alert waits for a person.
- MTTR (mean time to resolve or recover): how long until service is back. See what is MTTR.
- Incident count by severity and by service, to see where reliability work is needed.
Incident management vs. incident response
Incident response is the hands-on work during an incident. Incident management is the whole process around it, including preparation, on-call, communication and the follow-up afterwards. In security teams, incident response also has a specific meaning for handling breaches; see incident response.
Incident management with Atatus
Atatus covers detection and investigation. Alerting groups related issues into one incident and sends a single notification when it opens instead of one per alert, supports acknowledgement and maintenance windows, and routes incidents to PagerDuty, Opsgenie, VictorOps, Slack, Microsoft Teams, Jira, ServiceNow and more. AI SRE then groups related alerts into a Problem and suggests a probable root cause with evidence and an action plan.