Incidents

Incidents represent a period of degraded or failed service that requires attention. They are created automatically when a monitor detects a problem, or manually by a team member.

Incident Lifecycle

Every incident follows a defined lifecycle:

1. Unacknowledged -- The incident has been detected but no one has responded yet. Displayed with a red indicator.
2. Acknowledged -- Someone has seen the incident and is working on it. Displayed with an amber indicator.
3. Resolved -- The underlying issue has been fixed. Displayed with a green indicator.

Creating an Incident Manually

You can manually create an incident from the incident list page. This is useful when you need to trigger an escalation policy for a situation not detected by a monitor.

To create a manual incident:

1. Open the Incidents page.
2. Click the Create Incident button in the toolbar.
3. Fill in the form:
   • Title (required) — A short description of the incident.
   • Description (optional) — A detailed description, supports Markdown.
   • Escalation Policy (required) — The escalation policy to trigger. The first available policy is pre-selected.
4. Click Create.

The incident is immediately created and the selected escalation policy is triggered. You can then acknowledge and resolve it like any other incident.

Viewing Incidents

The incident list shows all incidents with filtering by status. By default, active incidents (Unacknowledged + Acknowledged) are shown.

• Search -- Find incidents by title or associated monitor name
• Status Filter -- Toggle visibility of each status type
• Incident Type -- Filter by how the incident was triggered: monitor failure, system incident, or manual incident
• Monitor Type -- Filter by the type of monitor that triggered the incident (OPC UA Endpoint, OPC UA Node, S7 Endpoint, S7 Tag, Heartbeat, CVE)
• Time Range -- Filter incidents by a time window. Click the clock icon to open the picker. Choose a quick preset or set a custom date and time range. Future dates cannot be selected.
• Auto-Refresh -- The list automatically refreshes every 5 seconds

Incident Details

Click on an incident to see its full details.

The detail page includes:

• Status -- Current incident state with visual indicator
• Related Monitor -- Link to the monitor that triggered the incident
• Timestamps -- When the incident started, was acknowledged, and resolved
• Acknowledged By -- Which user acknowledged the incident
• Activity Feed -- Chronological log of all events

Activity Events

The activity feed records events such as:

• Incident started
• Acknowledged by a specific user
• Resolved by a specific user
• Monitor failure details
• Monitor recovery details
• Email notifications sent
• SMS notifications sent
• Push notifications sent
• Voice call notifications sent
• Voice call ringing (attempted)
• Voice call declined
• Voice call not answered
• Alert email opened by a specific user

Push Notifications

When an incident is created and an escalation step with push notifications enabled is triggered, recipients receive a push notification on their registered devices. When the incident is later resolved, those same recipients receive a follow-up push notification confirming the resolution.

Comments

You can add comments to an incident's activity feed to share updates, context, or next steps with your team.

To add a comment:

1. Open the incident detail page.
2. Click Add Comment.
3. Write your comment — Markdown is supported, including task list checkboxes (- [ ] item, - [x] done).
4. Click Submit.

The comment appears in the activity feed, visible to all team members.

Actions

From the incident detail page, you can:

• Acknowledge -- Mark the incident as seen and being worked on
• Resolve -- Close the incident as fixed
• View Monitor -- Navigate to the related monitor's detail page

System Incidents

Pulse automatically raises system incidents when it detects operational issues that require administrator attention. These incidents appear in the same incident list as monitor-triggered incidents and trigger in-app notifications to all organization admins.

System incidents resolve automatically once the underlying condition clears — you do not need to resolve them manually.

Incident	Cause
Email delivery failure	An SMTP server failed to deliver a notification email.
No one available for escalation	An escalation policy was triggered but no recipient could be reached.
No one on call for [schedule]	A configured on-call schedule has no coverage during active operating hours.
Gateway disconnected	The appliance lost its connection to the Pulse gateway and could not reconnect.
Gateway enrollment failed	The appliance has not completed gateway enrollment. This appears during first-boot setup and resolves automatically once enrollment is finished.
No valid license	The organization has no active license. Some features may be limited.
License expiring soon	The active license is close to its expiry date.