Incidents

Incidents track service disruptions and their resolution. They can be created manually or promoted from auto-detected outages — system events that Warden creates automatically when a monitor goes down or becomes degraded.

Incident Types

Source	Description
Manual	Created by a user via the dashboard
Auto-detected	System-detected outages that can be promoted to tracked incidents

Auto-detected outages appear in the Active Issues tab as critical outages or performance issues. You can promote them to full incidents to add updates and make them visible on status pages.

Creating an Incident

1. Navigate to Incidents in the sidebar
2. Click Report Incident
3. Fill in the fields:
   • Title — a short description of the issue
   • Affected Group — the group experiencing the issue
   • Severity — Minor, Major, or Critical
   • Description — optional details about the issue
4. Click Create

The incident is created with status Investigating and the current timestamp as the start time.

Severity Levels

Severity	Use Case
Critical	Complete service outage
Major	Significant impact or partial outage
Minor	Low impact or cosmetic issue

Auto-promoted incidents default to Critical for down events and Major for degraded events.

Incident Statuses

Status	Meaning
Investigating	Issue reported, being diagnosed
Identified	Root cause found
Monitoring	Fix applied, watching for stability
Resolved	Issue confirmed fixed

When an incident is resolved, the end time is automatically set to the current timestamp.

Posting Updates

Incidents have a timeline where you can post updates as the situation evolves.

1. Expand an active incident
2. Enter an update message
3. Select the new status (Investigating, Identified, Monitoring, or Resolved)
4. Submit

Each update is timestamped and appears in chronological order on the timeline. Setting the status to Resolved closes the incident.

Promoting Outages to Incidents

When Warden auto-detects a monitor going down or becoming degraded, it creates an outage record. You can promote these to full incidents:

1. In the Active Issues tab, find the auto-detected outage
2. Click Create Incident
3. The title, description, and severity are pre-filled from the outage details:
   • Title defaults to “Service Disruption: {Monitor Name}”
   • Severity defaults to Critical (down) or Major (degraded)
   • Affected group is pre-selected
4. Customize the fields if needed
5. Click Create

The promoted incident:

• Links back to the original outage
• Starts with status Investigating (or Resolved if the outage already ended)
• Is marked as private by default — you must explicitly make it public
• Shows an Auto badge on the dashboard

Public vs Private Incidents

Incidents have a visibility toggle that controls whether they appear on public status pages.

Visibility	Behavior
Private (default)	Only visible on the dashboard to authenticated users
Public	Visible on public status pages and in RSS feeds

To toggle visibility, expand the incident and click Make Public or Make Private.

Manually created incidents and promoted outages both default to private. This lets you investigate before announcing to users.

Active Issues Tab

The Active Issues tab shows:

• Critical Outages — auto-detected monitors that are down
• Performance Issues — auto-detected monitors with degraded latency
• Certificate Warnings — SSL certificates approaching expiry
• Reported Incidents — manually created incidents that are still open

Incident History

The History tab shows resolved and completed incidents. Incident cards display:

• Title and description
• Severity badge
• Duration (calculated from start to end time)
• The full timeline of updates

How Incidents Appear on Status Pages

Public incidents appear on status pages in two places:

• Active incidents are shown prominently at the top with their latest status and affected groups
• Past incidents appear in a reverse-chronological list (if the status page has incident history enabled)

Only public and resolved/completed incidents appear in the past incidents section. RSS feeds also only include public incidents from the last 30 days.

Permissions

• Admin and Editor can create, update, delete incidents, post updates, promote outages, and toggle visibility
• Viewer can see incidents and their timelines but cannot make changes
• Status Viewer can only see public incidents on their assigned status pages