An Incident is the operational record of something that went wrong. While an Event is the rule that watches for problems, an Incident is the case your team manages once a problem is detected.
Incidents can be created in two ways:
Automatically — an Event fires and one of its configured actions is "Create Incident." The platform opens the Incident the moment the condition is triggered. See the Events article for how to configure this.
Manually — an operator notices an issue through a dashboard, an on-site observation, or a report from the floor, and creates the Incident by hand.
Note: The Incidents module is currently available to account owners and admin users only. |
Requirements
Industrial and Enterprise plans.
1. Accessing the Incidents module
In the left sidebar, go to Data → Events, then click the Incidents tab at the top of the screen.
2. The Incidents list
The Incidents list gives you a full view of all incidents in your account, with tools to filter, search, sort, and paginate through them.
2.1. Columns
Each row in the table represents one incident and shows:
Name: The incident title. Click it to open the detail panel.
Status: Current state — Open, Acknowledged, or Resolved.
Severity: The priority level assigned to the incident (see section 4.3).
Device: The device associated with the incident.
Trigger: The variable value and unit that caused the incident (for automatically created incidents).
Created at: Date and time the incident was opened.
Resolved at: Date and time the incident was resolved, if applicable.
Assigned to: The team member currently assigned to handle it, if any.
2.2. Filtering by status
Above the table, you'll see a status pill with all the available options: All, Open, Acknowledged, and Resolved. Click any option to filter the table to that status. Click All to remove the filter.
The active filter is reflected in the URL, so you can copy and share a filtered view with a colleague.
2.3. Search
Use the search bar to find incidents by name. The table updates as you type.
2.4. Sorting
Click any column header to sort the table by that column. Click again to toggle between ascending and descending order. An arrow indicator shows the active sort direction.
2.5. Pagination
The table loads incidents in pages. Use the pagination controls at the bottom to navigate. The total incident count is displayed alongside the controls.
Tip: Your filters, search, and sort state are saved in the URL. If you refresh the page, your view is preserved. |
3. The incident detail panel
Click any incident name to open its detail panel, which slides in from the right. The list remains visible behind it so you don't lose context.
The URL updates to /app/events/incidents/{id} — you can copy and share this URL directly with a colleague, and it will open with the correct incident already selected.
3.1. Incident metadata
At the top of the panel you'll find:
Title and description
Status: Open, Acknowledged, or Resolved
Severity: The assigned priority level
Device: The affected device
Trigger: The variable value that caused the incident (for automatically created incidents)
Assigned to: The team member responsible for handling it
3.2. Timeline
The right side of the panel shows a chronological Timeline — a read-only audit trail of everything that has happened during the incident's lifecycle.
Each entry in the timeline shows:
The type of event (status change or comment)
A description of what happened
Who did it and when (hover over the relative time to see the exact date and time)
The timeline cannot be edited or deleted — it is a permanent record of the incident's history. |
4. Create a manual incident
Use manual incidents for issues that sensors don't capture — field observations, operator reports, or problems discovered during maintenance rounds.
In the Incidents list, click the + button.
Fill in the form:
Name (required): A short, descriptive title.
Description: What was observed, where, and by whom.
Device: The device or variable associated with the issue.
Severity: The priority level based on operational impact (see section 4.3 below).
Assigned to: The person or team responsible to this incident. Users, contacts, or tags can be used here.
Click Save.
The new incident appears at the top of the list with status Open.
4.1. Acknowledge an incident
Acknowledging an incident signals that a team member has seen it and is actively working on it.
Click the incident name to open the detail panel.
Click Acknowledge.
Add a comment describing what action you're taking — for example: "Maintenance tech notified. Bearing inspection scheduled for 23:00h. Asset remains in operation under continuous monitoring."
Click Confirm.
The status changes to Acknowledged and your comment is saved in the timeline with your name and a timestamp.
4.2. Resolve an incident
Open the incident detail panel.
Click Resolve.
Add a closing comment documenting the root cause and the corrective action taken.
Click Confirm.
The status changes to Resolved. Resolved incidents are not deleted — they remain in the list and their full timeline is preserved. Use the status filter to hide resolved incidents from your working view.
4.3. Severity
When creating or editing an incident, you can assign one of the following severity levels:
Level | Code | Typical use |
Critical | P1 | Asset at risk of failure, production stopped |
High | P2 | Degraded performance, intervention required soon |
Medium | P3 | Out of range but stable; monitor closely |
Low | — | Informational; track but no immediate action needed |