What counts as an incident

01The short answer#

An incident is something broken right now that is costing you: customers can't sign up, pay or log in, and the cost grows every minute nobody acts. If nothing is being lost while it waits, it's a bug, and it belongs in the backlog.

Keep that line sharp. A team that pages itself for a broken image on the blog gets slower at a broken checkout, because the alert has stopped meaning anything.

An incident titled Checkout returning 502: a timeline from the deploy to the recovery seven minutes later, beside the log lines from that window — An incident page: the deploy, the failed checks and the recovery on one timeline, with the log lines from those minutes. Sample data.

02What a good incident carries#

When it started, and whether it's still going.
What changed right before: a deploy, a config change, an expired certificate.
The actual error, not just "down".
Who is on it, so two people don't fix the same thing.

03Incidents in UpControl#

UpControl opens an incident only after 3 failed checks in a row, so a blip never wakes anyone, and closes it on the first success. The title names the failure, like "Checkout returning 502" or "DNS error".

Each incident keeps the log lines from around the failure and puts your deploys and events from the 30 minutes before it on its timeline. In Telegram, Acknowledge and Resolve buttons record who took it. Most of the "what happened?" work is done before you even open it.