Incident Management
This domain tests the incident lifecycle: how a signal becomes an incident, how on-call ownership is assigned, how escalation and communication work, and how resolution and learning close the loop. Expect questions on services, escalation policies, schedules, urgency, priority, and status updates.
Core rules and objects
- A service is the unit of ownership. It must have an escalation policy and usually an integration; incidents inherit the service's policy, urgency, and priority settings.
- Escalation policies are ordered rules with targets (users, schedules) and timeouts. They fire when no one acknowledges within the timeout. Acknowledgment assigns the incident and stops further escalation; resolution closes it.
- Schedules define who is on call, with layers, overrides, and restrictions. Overrides replace a shift for a person; restrictions limit availability by time/day.
- Notification rules determine how a user is contacted (push, SMS, phone, email) for high- and low-urgency incidents.
- Urgency (high/low) controls notification behavior; priority (P1-P5) communicates business impact. They are not the same field.
- Status updates and status pages keep stakeholders informed; postmortems capture timeline, impact, causes, and actions.
Worked example
A high-urgency alert hits the "Checkout" service. Its policy: schedule "Checkout Primary" for 5 minutes, then "Checkout Secondary" for 10 minutes. At minute 3 the primary acknowledges in the mobile app. Escalation stops, the incident is assigned to that responder, and a status update is posted. The responder resolves after a rollback. Because the incident was high impact, a postmortem is opened.
Traps
- Assuming acknowledgment resolves the incident; it only stops escalation and assigns ownership.
- Mixing urgency and priority; urgency drives notifications, priority drives impact reporting.
- Forgetting that an escalation policy needs at least one rule and a target; a service without a policy cannot route correctly.
- Treating an override as a permanent schedule change; overrides are time-bound.