Incident workspace

The incident workspace contains various panels containing incident details and possible actions.

The top header contains description information, tags, impact information, elapsed time, promotion or creation identity, and priority. Standard buttons move the status or save the record.
Note: Tags are imported from third-party integrations and attached to incidents. However, you can also create tags to categorize data and drive system logic using the tag icon Tag icon. For more information on creating and viewing tags, see Manually create Incident Response tags.

Details

This section contains three content panels: Details, Compose, Incident timeline
Note: When an editable field is updated, notifications are sent based on user notification preferences.
Table 1. DetailsContains incident details and related alerts
Field Description
Service Services in your infrastructure associated with the incident. You can edit this field from a list menu.
Note: When you set a service, and that service has an assigned team, the assigned team of that service is automatically assigned to the incident.
Priority Imported priority on the incident. Values P1–P5.
Assigned team Team the assignee belongs to. You can edit this field.
State Incident state. See Incident states for more information.
Assigned to Individual the incident has been assigned to. You can edit this field.
Source Source of the incident.
Supporting teams Team selected to support the incident. Once a team is selected, the current, primary on-call responder for that team is added to the Responder list in the Collaboration panel. You can edit this field and select multiple teams.

When a Service is deleted, its integrations, alerts, incidents, and automation rules are removed. This is not a recoverable action so consider deactivating the service instead.

Related Alerts tab

This tab contains any alerts associated with this incident.

Note: All field values are imported from the related alert record. Team, Service, and Assigned to fields are links to the Team, Service, and User pages.
Field Description
Number & Description Related alert identifier and short description.
Service Service associated with the related alert.
Priority Priority group for the related alert.
State Status of the related alert.
Ack States whether the related alert has been acknowledged or not.
Team Team assigned to the related alert.
Assigned to Responder the related alert is assigned to.
Source Source of the related alert, if known.
Postmortem tab

A postmortem helps you develop a culture of improvement, where you identify what happened, how it happened, and action items to prevent it from happening again.

About Postmortem owner:
  • If a Scribe has already been chosen in the Collaboration panel Responders list, they are automatically made the owner.
  • If there is more than one scribe then the first one assigned is chosen. Otherwise, you can select an owner from the list menu.
  • If a new scribe is added or an existing user persona is changed to Scribe, that user is made the owner.
  • If you manually remove an owner, no new owner is automatically selected.

Each section of the postmortem can be edited, excluded from a PDF, deleted, or reordered using drag-and-drop.

You can add new sections using the add icon Alt text for icon-add.png.

For more detailed information on editing postmortems, see View or edit an incident postmortem.

Compose

Work notes: Add comments and post Work notes to the Incident timeline activity stream. Visible to responders and above. Notifications are sent for all updates based on user notification preferences.

Comments: When a comment is added to an incident, stakeholders are notified by email or their notification preferences.
Note: Use the stack icon stack icon Stack icon to reformat the panel to a stacked view.
Incident timeline
Stream that contains all the system activity, comments, and work notes. You can filter, sort, expand or collapse all posts using the header icons.
Activity header icons
Attachments

The Attachments panel is hidden until you select the attachment icon attachment icon.

On the Attachments panel, you can initially Browse your local hard drive for files.

Once you have added attachments, you can:
  • Search for an attachment based on its name or extension
    Note: You must have two or more attachments to search.

    Search attachments
  • Upload a new attachment using the (add icon) icon
  • Download an existing attachment using the More actions icon (More actions icon) to the right of the attachment.
  • Remove an existing attachment using the More actions icon to the right of the attachment.
  • Rename an existing attachment using the More actions icon to the right of the attachment.

    Attachments menu
Collaboration panel

Displays available Zoom meeting or Microsoft Teams or Slack channels to start or join.

To start or join a Zoom meeting:
Note: The Zoom integration and recognized IDs must be active in your instance. If Start Channel is unavailable, contact your administrator. See Zoom integration with Incident Response for more information.
  1. Select Start Zoom.
    • A meeting pop-up appears.
    • Add participants.
    • Select Create Meeting.
    • The meeting is created, invitations are sent, and you join the meeting.
  2. Select Join Meeting
    • Sign in to your Zoom account.
    • You join the Zoom meeting.
Start or join a Microsoft Teams channel:
Note: The Microsoft Teams integration and recognized IDs must be active in your instance. If Start Channel is unavailable, contact your administrator. See Microsoft Teams integration with Incident Response for more information.
  1. Select Start Channel.
    • Sign in to your Microsoft Teams account.
    • Select Create. You are redirected to the Microsoft Teams application.
    • Back in the Collaboration column, the Join Slack button is activated.
  2. Select Join Channel in the Collaboration panel in Lightstep Incident Response.
  3. Sign into your Microsoft Teams account.

    You are taken to the channel in Microsoft Teams.

Start or join a Slack channel:
Note: The Slack integration and recognized IDs must be active in your instance. If Start Channel is unavailable, contact your administrator. See Slack integration with Incident Response for more information.
  1. Select Start Slack.
    • Add participants in the Create a Slack channel pop-up.
    • Select Create. You are redirected to the Slack application.
    • Back in the Collaboration column, the Join Slack button is activated.
  2. Select Join Channel in the Slack application window.
  3. Sign into you Slack account.

    You are taken to the Slack channel.

Note: When a Zoom meeting, Microsoft Teams, or Slack channel is created, details for the meeting or channel are posted as work notes to the timeline.
Responders panel

Responders and Stakeholders panel

Add responders or stakeholders from the list menu and select the Add icon.

To assign Responders to incident personas, add a responder and select the role from the list menu. For more detailed information on incident roles, see Incident personas.

Responders are notified based on their notification preferences.

Note: The primary on-call responder from teams in the Supporting teams fields for services or incidents appear automatically in the responders list once you Save the form.

Incident stakeholders or external emails defined on the service are automatically added to incidents affecting that service. They are notified by email or according to their preferences.

Helpful links

Helpful links are defined in the affected service for this record. See Create a service for detailed information on adding links.

Helpful links panel
The Manage links button takes you to the Service details record where you can add or edit links. You can have up to 20 links and each link is opened in its own tab.
Note: If the service changes, the helpful links refresh to display the links associated with the new service.