Incidents
Incidents are Guardian’s ticket system for tracking a problem from detection through resolution. A critical alert automatically opens an incident — Technicians and Superadmins can also open one manually.
Lifecycle
Section titled “Lifecycle”Incidents move through four statuses:
New → Acknowledged → Investigating → Resolved
The dashboard header shows live counts of open, new, and investigating incidents. The Open tab groups everything that isn’t resolved yet.
Creating an incident manually
Section titled “Creating an incident manually”Click + New Incident and provide:
- Title (required) and optional description
- Hostname
- Severity: Critical, Warning, or Info
- Category: Hardware, Software, Network, Security, or Other
Working an incident
Section titled “Working an incident”Select an incident to open its detail panel, which shows:
- Status transitions — move the incident to its next valid status, optionally with a note explaining the change. A resolved incident can be reopened by transitioning it back to New.
- Assignment — assign the incident to a teammate by name, or unassign it.
- Timeline — when the incident was detected, acknowledged, investigated and resolved, with each step’s time and how long after detection it happened, plus your notes in chronological order. It also shows time to acknowledge and time to resolve so you can see how quickly the team responded. If an incident has been escalated, the timeline shows when. Only steps that really happened are listed.
- Affected resource — the incident’s host, with a View in Agents button that opens the Agents screen filtered to it, and a list of other incidents on the same host (including resolved ones) so you can see whether this has happened before. Click one to open it.
- Notes — a threaded log of comments. Every status change also adds an automatic note.
Only Technicians and Superadmins can transition status, assign incidents, or add notes; other roles can view incident details.
Escalation
Section titled “Escalation”An incident nobody acknowledges within the configured window automatically escalates to Slack and/or PagerDuty — a separate mechanism from regular alert delivery (Notification Channels), specifically for things going unhandled. Configure your own PagerDuty integration key from Settings → Notifications to route escalations to your own on-call rotation instead of the platform default (Enterprise plan). Slack escalation uses the same Slack configuration as regular alert delivery.
Related pages
Section titled “Related pages”Incidents created automatically originate from alerts. Updates to an incident’s status don’t send notifications on their own — see Notification Channels for how your team gets alerted in the first place.