Incident timeline and comments
The running record of an incident: what ilert logged, what your team wrote down, and what was said publicly.
The right-hand panel of the incident view is the incident's memory. It has three tabs.
Timeline
Everything that happened, logged automatically, plus your comments
Status updates
The public messages posted from this incident
Investigations
What an AI agent found when set to work on the incident
The timeline
The timeline is append-only, in chronological order, so someone joining an hour late can read down it and catch up. ilert writes to it by itself, recording at least:
the incident being declared, and by whom,
severity and status changes,
responders added, paged, and joining,
alerts linked and unlinked,
an incident channel or conference bridge being attached,
status updates being posted.
Nothing on it can be edited or deleted. That is the point: it is what a post-mortem is reconstructed from, and a record you can rewrite is not evidence.
Comments
Comments are the parts the machine cannot know. Type into Add comment to timeline and send.
Worth writing down as you go, because nobody remembers it afterwards:
what you found — "Connection pool exhausted on db-primary-1",
what you decided and why — "Rolling back rather than hotfixing, the fix is unverified",
what you handed over — the state of things when responsibility moves between people or regions.
Saying something publicly
The timeline is internal — all of it, always. Customers see nothing from it.
To communicate, click Post status update. A status update is a separate, deliberately written, public message that goes to your status pages and subscribers. The incident's title, summary, severity, and timeline are not part of it, and never leak into it.
The timeline records that you posted one, and the Status updates tab keeps what you said. See Status updates for writing and resolving them.
Last updated
Was this helpful?