Incident Management

Incidents in MonSPHERE aren't a separate manual workflow bolted onto alerting — incident-service opens one automatically whenever an alert rule fires, and resolves it automatically when the underlying condition clears.

Incident lifecycle

1. Alert rule fires → SubjectAlertReceived event published
2. incident-service opens a new incident, linked to the triggering alert and monitor
3. Team members are assigned, add updates, and track resolution
4. Condition clears → SubjectAlertResolved → incident auto-resolves, or is resolved manually

Assignment and updates

curl -X PATCH https://api.monsphere.com/api/v1/incidents/:incidentId \
  -H "X-Api-Key: msk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"assigneeId": "...", "status": "investigating"}'

Notifications on incident events

Incident creation and resolution both publish events that notification-service and webhook-worker pick up — so your Slack channel or PagerDuty escalation reflects real incident state, not just the raw alert.

Reporting on incidents

Incident history feeds directly into SLA reporting — MTTR, incident count, and uptime percentage are computed from the same real incident records your team works out of, not a separately-maintained log.