> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Handle and Update Incidents

> Learn how to modify incident title and other information, how to handle incidents, and sync status with others

## Modify Information

After an incident triggers, its symptoms may become clearer over time. You can modify key information like the incident title to make it more accurate than the original alert information.

<Tabs>
  <Tab title="Modify Incident Title">
    <Steps>
      <Step title="Open Incident Details">
        Click to open incident details in console, in the title section, click the edit button.
      </Step>

      <Step title="Enter New Title">
        Enter the new title, done.
      </Step>
    </Steps>

    <Note>
      The modified title won't change when new alerts merge in.
    </Note>
  </Tab>

  <Tab title="Modify Incident Severity">
    <Steps>
      <Step title="Open Incident Details">
        Click to open incident details in console, in the severity section, select new severity.
      </Step>

      <Step title="Complete Modification">
        Mouse unfocus, done.
      </Step>
    </Steps>

    <Note>
      The modified severity won't change when new alerts merge in.
    </Note>
  </Tab>

  <Tab title="Modify Incident Description and Impact">
    <Steps>
      <Step title="Open Incident Details">
        Click to open incident details in console, in description and impact sections, click to directly enter new information.
      </Step>

      <Step title="Auto Save">
        System automatically saves.
      </Step>
    </Steps>

    <Tip>
      You can use Markdown syntax to update incident description and impact, or directly copy-paste images!
    </Tip>

    <Note>
      The modified description won't change when new alerts merge in.
    </Note>
  </Tab>
</Tabs>

## Acknowledge Incident

You have three ways to acknowledge a newly triggered incident.

<Tabs>
  <Tab title="Acknowledge via Console">
    * **Single Acknowledge**: Click incident details in console, click **Acknowledge** button to complete
    * **Batch Operation**: In console incident list, select multiple triggered incidents, click **Acknowledge** button for batch acknowledgment
  </Tab>

  <Tab title="Acknowledge via IM App">
    * **App Messages**: App message main card provides an **Acknowledge** button, click the card to complete acknowledgment. If clicking the card has no effect, you may not have completed login account linking in the app or other reasons. See [Feishu/Lark Integration Guide](/en/on-call/integration/instant-messaging/lark) for details
    * **Bot Messages**: Most bot channels push messages in Markdown format. You can modify notification templates to add an **Acknowledge** redirect link for jumping to console to acknowledge. See default templates for details
  </Tab>

  <Tab title="Acknowledge via Voice Call">
    Flashduty On-call voice alerts remind you to **press 1 to acknowledge** at the end of the voice broadcast. Press key 1, and the system acknowledges the incident on your behalf.
  </Tab>
</Tabs>

### Unacknowledge Incident

Once anyone acknowledges, incident progress changes from "Triggered" to "Processing". Others acknowledging won't change the progress.

After acknowledging, you can choose to **Unacknowledge**, useful for accidental acknowledgments. When all acknowledged personnel unacknowledge, incident reverts to **Triggered** status.

### Progress and MTTA

You can view each person's assignment time and acknowledgment time in the console. We calculate incident MTTA as follows:

| Metric                | Description                                                                                                                          |
| :-------------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
| MTTA Definition       | Mean Time to Acknowledge, average acknowledgment time, the average difference between acknowledgment time and trigger time           |
| Individual MTTA       | For the same incident, each person can have different assignment and acknowledgment times, so each person's MTTA calculation differs |
| Overall Incident MTTA | Only calculates the difference between incident trigger time and first acknowledgment time                                           |

## Snooze

After acknowledging an incident, responders may need time to investigate and handle it. **Snooze** can temporarily stop the incident from escalating per the expected escalation rule. After acknowledging, you can choose from preset durations (default: 2 hours, 4 hours, 12 hours) or set a custom expiration time within 24 hours.

<Tip>
  Account administrators can click the **configuration icon** (gear) directly in the snooze dropdown to customize the 3 snooze preset durations. Each preset supports selecting **hours** or **minutes** as the unit, and each value must be greater than 0 and no more than 24 hours. Changes take effect for all members.
</Tip>

<Warning>
  If you've snoozed and the snooze time has passed but you still haven't resolved the incident, the system automatically reverts the incident to **Triggered** status and re-initiates assignment notifications.
</Warning>

<Tabs>
  <Tab title="Snooze via Console">
    Click incident details in console, click **Snooze** button, select snooze duration, done.
  </Tab>

  <Tab title="Snooze via IM App">
    Click **Snooze** button on incident message card, select snooze duration, done.
  </Tab>
</Tabs>

## Close Incident

You have multiple ways to close an incident.

<Tabs>
  <Tab title="Close via Console">
    * **Single Close**: Click incident details in console, click **Close** button to complete
    * **Batch Operation**: In console incident list, select multiple triggered incidents, click **Close** button for batch closure
  </Tab>

  <Tab title="Close via IM App">
    App message main card provides a **Close** button, click the card to complete closure. If clicking the card has no effect, you may not have completed login account linking in the app or other reasons. See [Feishu/Lark Integration Guide](/en/on-call/integration/instant-messaging/lark) for details.
  </Tab>
</Tabs>

### Reopen Incident

Manually closing an incident changes progress to **Closed**. You can click **Close** in any status. Once manually closed, associated alerts stop merging new events. If alerts haven't recovered in the original monitoring system, new notification events may occur, triggering new alerts and incidents in Flashduty On-call.

You can reopen accidentally closed incidents. Follow these steps:

<Steps>
  <Step title="Initiate reopen">
    In the closed incident details page, click the **Reopen** button.
  </Step>

  <Step title="Enter reopen reason">
    In the dialog that appears, enter the reason for reopening. This field is required, used to record the context for reopening.
  </Step>

  <Step title="Confirm and submit">
    Click **Save** to complete. The incident reverts to **Triggered** status and re-initiates assignment and notification.
  </Step>
</Steps>

<Note>
  The reopen operation supports batch operations. You can select multiple closed incidents in the incident list and reopen them together.
</Note>

## More Actions

The **More** button at the top right of the incident details page groups supplementary actions beyond the high-frequency action buttons. The visible items are rendered dynamically based on the incident's progress and acknowledgment state.

| Action                           | Description                                                                                                                                                                                   |
| :------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Merge into Incident**          | Merge the current incident into another target incident; after the merge, alerts from both incidents are consolidated and handled within the target incident                                  |
| **Quick Silence**                | Jump to the alert silence configuration page of the incident's channel with key fields of the current incident pre-filled, so you can quickly create a targeted silence rule                  |
| **Unacknowledge**                | Only shown if you have acknowledged and the incident is not yet closed; used to revoke a prior acknowledgment. Once all responders have unacknowledged, the incident reverts to **Triggered** |
| **Invite Followers to War Room** | Only shown if a war room has been created for the incident; lets you pull additional members into the corresponding IM war room group                                                         |
| **Close War Room**               | Only shown if a war room has been created for the incident; closes the IM war room group. See [War Room](/en/on-call/advanced/war-room) for details                                           |
| **Custom Actions**               | Jira, ServiceNow, ServiceDesk Plus, and general custom actions configured by administrators in integrations                                                                                   |

<Tip>
  For incidents that have been closed but do not yet have a postmortem report, a **Postmortem** shortcut button appears directly on the action bar. Click it to jump to the **Postmortem** tab and start writing.
</Tip>

## Merge

You can manually merge between incidents, or between incidents and alerts. Merging similar alerts and incidents together consolidates information into the same incident, accelerating the handling process.

| Operation               | Description                                                                                                                                                                                     |
| :---------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Merge Incidents         | Select multiple incidents in console and merge into a target incident. Or in an incident's details, select other target incidents to merge into                                                 |
| Merge Alert to Incident | Alerts may be grouped into incidents by grouping rules, but you may want to adjust alert-incident associations. Go to alert details, click **Merge Into**, migrate the alert to target incident |

<Note>
  The essence of merging is: changing alert-incident associations. If all alerts of an incident merge into others, that incident closes directly, and you only need to handle the target incident. Timeline completely records your modification process.
</Note>

## FAQ

<AccordionGroup>
  <Accordion title="I snoozed an incident, why does the system still trigger new similar incidents?">
    You may have confused **Snooze** with **Silence**, they're quite different.

    | Feature | Description                                                                                                                                                           |
    | :------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Silence | Requires matching rules; when newly triggered incidents match silence rules, notifications won't be sent. Silence rules can affect new incident trigger notifications |
    | Snooze  | No rules required; only gives you time to handle the incident after acknowledging, preventing escalation to next level responders during handling                     |

    If you need to suppress an alert policy, use **Silence**, not **Snooze**.
  </Accordion>
</AccordionGroup>
