View an incident

View all incidents in the system.

Before you begin

Role required: Responder, Manager, Administrator, or Stakeholder


  1. Log in to Lightstep Incident Response.
  2. On the left navigation pane, select Incidents.
    Note: Initially, the incidents page is empty, until you ingest incidents from a third-party integration. See Integrations in Incident Response for more information on setup and ingestion.

    The list view is automatically updated when a new record is created or inserted.

  3. View your incidents list.
    Incident list view

    Search incidents using the Search text box.

    The incident list view can be sorted in order by:
    • Priority (asc)
    • Priority (desc)
    • Elapsed Time (asc) - Default
    • Elapsed Time (desc)
    • Number (asc)
    • Number (desc)
    You can filter the listings using the Filters menu in the header.
    Note: Filters for the same fields evaluate as AND, filters for different fields evaluate as OR. For example, if you filter for Priority and State is Open, the filter evaluates as P1-Critical OR P2-High OR P3-Moderate AND State Open.

    If you select Incidents in the left navigation, it defaults to all Open incidents initially.

    When you change your incident list view filters, it remembers your settings, automatically, so that if you navigate away they are still set when you return.

  4. Optional: Create an incident.
    See /incident-response/docs/create-incident for more information.
  5. Optional: Select the information icon information icon to the left of an incident for a preview.

    The fly-out screen contains the incident header including tags, Details, and Activity areas of the incident. See Incident workspace for more information on those fields.

    Placeholder alt text for incident-flyout
    More actions, More actions icon lets you:
    • Accept, Resolve, Close or Reopen the incident based on its state.
    • Show full details of the incident.
    You can edit the Service, Priority, Assigned team, Assigned to and Supporting teams fields in the flyout screen and Save.
    Note: On-call users for the supporting teams are added to incident responder lists.
  6. Optional: Bulk select incidents to resolve using the list checkboxes for each incident Incident checkbox or for all incidents Bulk selection for incidents then select Resolve.
    Note: Filters apply when making selections for incidents. Make sure you have the correct filters and selections before using the Resolve button.
  7. Select an incident or use Show full details from the flyout screen for the incident.

    The incident form contains not only the information related to the incident but options to search for further information and take actions. See the following example of an open incident.

    The Details page is automatically updated any time a change is made.

    If the incident is not assigned to you, you can Accept it. This action auto-assigns the incident and advances the state to Work in Progress.
    Note: Not visible if the incident is already assigned to you.

    Once the incident is assigned to you and you have accepted, you can:

    • Advance the state from Work in Progress to Resolve to Close.

      See Incident states for more information on each of the actions listed.

    • Add or edit a Service.
    • Edit Priority.
    • Review the Related alerts.

      See Incident workspace for more information on these fields.

    Note: Once you edit a field, the Save button becomes active so you can save the changes.
  8. Select the Related alerts tab to view any related alerts.
    Incident related alert list

    Alert information is copied from the alert record.

    See Incident workspace for more information.

  9. Select the Postmortem tab to view or edit postmortem data.
    Postmortem tab

    For detailed information on editing the Postmortem tab, see View or edit an incident postmortem or Incident workspace.

  10. View the Compose panel to add Work notes to the Incident timeline.
    Alt text for incident-compose.png
  11. View the Incident timeline panel activity stream.

    The timeline shows system activity since the incident was created and all work notes.

    You can filter, sort, or expand and collapse posts using the icons in the header.

    Incident timeline
  12. Add or view attachments using the attachment icon icon in the upper right of the Attachments panel. This icon opens or hides the column.
  13. View the Collaboration panel using the collaboration icon Collaboration icon. This icon opens or hides the column.
    • Start or join an available Zoom meeting.
    • Start or join an available Microsoft Teams channel.
    • Start or join an available Slack channel.
    • Add responders or stakeholders to the incident.
    • Send email updates to stakeholders from the Stakeholders tab.

    See Incident workspace for more information on each of the actions listed.

  14. Use the incident screen icons icons at the bottom of the screen to display: the incident form in full screen, the incident form and activity area, or the activity area in full screen.
  15. View the Helpful links panel using the helpful links icon helpful links icon. This panel contains links defined on the affected service for this record.

    See Incident workspace for more detailed information.