# Incidents Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fincidents.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fincidents.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[API reference](https://docs-docusaurus.kinsta.page/api-reference/v5/events-service/.md) The Incidents screen displays all triggered alert events in Coralogix. View currently active alerts or filter by timeframe, status, type, or severity. Drill down into any incident to investigate the underlying logs, metrics, and traces that triggered it. Cases is replacing Incidents [Cases](https://docs-docusaurus.kinsta.page/user-guides/cases/overview/.md) is an upgrade to Incidents, and Incidents will be gradually replaced. New accounts work with Cases by default. To understand how the two differ, see [Cases vs Incidents](https://docs-docusaurus.kinsta.page/user-guides/cases/cases-incidents/.md). For programmatic access, use the [Cases API](https://docs-docusaurus.kinsta.page/developer-portal/apis/data-management/cases-api/.md). Note The Incidents page filters results based on the alert's **retriggering period**. An actively firing alert may not appear if the next retriggering event has not occurred within the selected time window. For consistent visibility of active issues regardless of retriggering period, use [Cases](https://docs-docusaurus.kinsta.page/user-guides/cases/overview/.md). ## What you can do[​](#what-you-can-do "Direct link to What you can do") * **View** all triggered alerts or filter by timeframe * **Organize** incidents by alert definition * **Filter** by status, type, severity, labels, or assignment * **Update** incident status (triggered, acknowledged, resolved) * **Drill down** into any triggered event to view its contextual data * **Sort** alerts in chronological order ## How incidents are organized[​](#how-incidents-are-organized "Direct link to How incidents are organized") Triggered alerts are bundled as incidents based on the **Group By** tags and notification settings defined in your [alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/introduction-to-alerts/.md). ### Group by tags[​](#group-by-tags "Direct link to Group by tags") The Incidents screen shows all permutations for the key-value tags selected in the **Group By** conditions of your alert. [![Incidents screen showing group by tags](/assets/images/image-2-3-1024x473-d963a0843eedbb084f458962f69e223c.jpg)](https://docs-docusaurus.kinsta.page/assets/images/image-2-3-1024x473-d963a0843eedbb084f458962f69e223c.jpg) Alerts are grouped by one or more key-value tags aggregated into a histogram. An alert triggers when the condition threshold is met for a specific aggregated key within the specified timeframe. When using two Group By tags, matching data is first aggregated by the parent tag (for example, `applicationName`), then by the child tag (for example, `subsystemName`). The alert fires when the threshold meets the unique combination of both. Only data that includes the selected Group By tags is counted. ### Notification grouping[​](#notification-grouping "Direct link to Notification grouping") How incidents appear depends on the notification setting in your alert: * **Separate notifications**: each key-value combination that meets your Group By conditions appears as a separate incident * **Single notification**: all events for the alert are consolidated into one incident [![Incidents notification grouping](/assets/images/image-2-1-1024x491-14855129e5601e3bef6ff44c2b09ac37.jpg)](https://docs-docusaurus.kinsta.page/assets/images/image-2-1-1024x491-14855129e5601e3bef6ff44c2b09ac37.jpg) ## Prerequisites[​](#prerequisites "Direct link to Prerequisites") * [S3 archive bucket](https://docs-docusaurus.kinsta.page/user-guides/data-flow/s3-archive/connect-s3-archive/.md) configured for querying alert logs in Explore ## View incidents[​](#view-incidents "Direct link to View incidents") Navigate to **Alerts**, then **Incidents** to view all triggered alerts. ### Incidents tab[​](#incidents-tab "Direct link to Incidents tab") The **Incidents** tab shows all alerts triggered within the selected timeframe, regardless of status or duration. Events are sorted by last updated timestamp. Select a time range using: * **Quick**: preset time ranges * **Relative**: timeframe relative to now * **Custom**: specific start and end time * **Tag**: compare timelines using [Version Benchmarks](https://docs-docusaurus.kinsta.page/user-guides/monitoring-and-insights/version-benchmarks/.md) ### Group by alert definition[​](#group-by-alert-definition "Direct link to Group by alert definition") Select **Group by alert definition** in the upper-right corner to aggregate all permutations under one alert name. Expand an alert group to view individual permutations with status, type, and details. Each group can contain up to 1,000 permutations. ### Filter incidents[​](#filter-incidents "Direct link to Filter incidents") Use the sidebar filters to narrow results by status, type, priority, labels (with AND/OR operators), or assignment. ## Incident status[​](#incident-status "Direct link to Incident status") Incidents have one of three statuses: | Status | Description | | ---------------- | --------------------------------------- | | **Triggered** | The alert condition is active | | **Acknowledged** | A team member has accepted the incident | | **Resolved** | The issue has been addressed | ### Automatic status changes[​](#automatic-status-changes "Direct link to Automatic status changes") When a triggered alert resolves, the incident status automatically changes to resolved. If **Notify When Resolved** is enabled in the alert settings, a resolve notification is sent. Once resolved, the incident closes. If the alert triggers again, a new incident appears. ### Manual status changes[​](#manual-status-changes "Direct link to Manual status changes") Select a triggered status to change it to acknowledged or resolved. Changing the status automatically assigns you to the incident. Modify status from the Incidents screen or the incident details screen. [![Incident status change options](/assets/images/Untitled-58-34efb014cb5aa84a328bcc217826cb36.webp)](https://docs-docusaurus.kinsta.page/assets/images/Untitled-58-34efb014cb5aa84a328bcc217826cb36.webp) ## Incident details[​](#incident-details "Direct link to Incident details") Select the more actions menu on any incident to open the incident details screen: * Alert name and status * Event history and timestamps * Severity, time window, application, and subsystem * Alert query * Assignee Select the edit icon to open and modify the alert definition. ### Group by state[​](#group-by-state "Direct link to Group by state") For single-notification alerts, the **Group By State** grid displays all permutations for the key-value tags in the Group By conditions. ### Watch data[​](#watch-data "Direct link to Watch data") Select **Watch Data** to view the logs, metrics, or traces that triggered an event: * **Watch Data** in the upper-right corner shows raw data for the last event * **Watch Data** next to a specific event shows raw data for that event ## Alert Explorer[​](#alert-explorer "Direct link to Alert Explorer") Alert Explorer displays all triggered alerts in chronological order without grouping them into incidents. Filter alerts using the same methods as the Incidents screen, except for the assignment filter. ## Additional resources[​](#additional-resources "Direct link to Additional resources") | | | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Documentation | [Connect S3 Archive](https://docs-docusaurus.kinsta.page/user-guides/data-flow/s3-archive/connect-s3-archive/.md)
[Introduction to alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/introduction-to-alerts/.md) | ![Incident Management Intro and UI](https://img.youtube.com/vi/l3LBgDUclMA/mqdefault.jpg) Incident Management Intro and UI ![Visualizing, Searching and Filtering Alerts](https://img.youtube.com/vi/__15yWxwYg0/mqdefault.jpg) Visualizing, Searching and Filtering Alerts ![Diving into a Specific Incident](https://img.youtube.com/vi/-2VnVYRrVDg/mqdefault.jpg) Diving into a Specific Incident ![Different Incident Visualization Screens](https://img.youtube.com/vi/R-KGJcAiM3M/mqdefault.jpg) Different Incident Visualization Screens ## Next steps[​](#next-steps "Direct link to Next steps") Automate periodic alert reports with [Coralogix reporter](https://docs-docusaurus.kinsta.page/user-guides/alerting/coralogix-reporter/.md). ## Related resources[​](#related-resources "Direct link to Related resources") [Cases](https://docs-docusaurus.kinsta.page/user-guides/cases/overview/.md)[Cases vs Incidents](https://docs-docusaurus.kinsta.page/user-guides/cases/cases-incidents/.md)[Notification Center](https://docs-docusaurus.kinsta.page/user-guides/notification-center/introduction/.md)