Incidents
Understand incident sources, lifecycle states, timelines, and terminal resolution behavior
An incident records a condition that needs attention. MonitoringDog opens incidents from checks, custom incident services, manual actions, or system events, then records status changes and notification activity in the incident timeline.
Read How Checks Work if you need to understand how check confirmation and recovery periods create or resolve incidents.
Incident sources
An incident can come from more than one product area.
| Source | What creates it | What the incident shows |
|---|---|---|
| Check | A monitored target fails after MonitoringDog confirms the failure | Check URL, method, locations, failure cause, and related check details |
| Custom incident | An external system triggers a custom incident service | Custom incident name, requester information, summary, and description |
| Manual or system event | A responder or MonitoringDog records an incident event | The action, actor when available, and event time |
The incident details page links back to the related check or custom incident when the source exists.
Status lifecycle
Incidents move through a small state machine.
| Status | What it means | What can happen next |
|---|---|---|
| Ongoing | MonitoringDog opened the incident and the condition still needs attention | The incident can be acknowledged, recover, reappear, or resolve |
| Acknowledged | A responder accepted ownership of the incident | The incident can recover, reappear, or resolve |
| Recovered | MonitoringDog detected recovery and is waiting for the recovery path to complete | The issue can reappear or the incident can resolve |
| Issue reappeared | The condition failed again after recovery started | The incident remains active until recovery or resolution happens |
| Resolved | The incident no longer needs action | The incident is closed and cannot reopen |
Resolved is terminal. Once an incident is resolved, MonitoringDog does not reopen the same incident from a late callback or a later status write.
Timeline events
The timeline explains what happened and when. It can include:
| Event type | Examples |
|---|---|
| System events | Incident started, monitor recovered, recovery wait started, issue reappeared, incident resolved |
| Notification events | Email, push notification, Slack, Microsoft Teams, Discord, webhook delivery |
| Manual events | Acknowledgement, manual resolution, escalation |
| Comments | Notes added by responders |
Use the timeline to separate detection, notification delivery, acknowledgement, recovery, and final resolution.
Metrics and postmortems
MonitoringDog can expose incident metrics such as response and resolution timing through the incident API. Incident postmortems are attached to a specific incident and require incident management access to create or update.