Skip to main content

​
Incident List

Flashduty On-call provides two entry points to view the incident list. One is within a channel, the other is under the Incident Management menu. The difference is that under Incident Management, you can see incidents from multiple channels, even all incidents across the entire account.
Incident List Interface
For query performance, the query time range is limited based on your subscription tier:
  • Free: up to 30 days
  • Standard: up to 180 days
  • Professional: up to 366 days
To query older data, adjust the start and end times, or use the Incident Query API.
To improve performance, when search conditions match more than 1000 incidents, the system only displays 1000+, not the exact number. Therefore, you can only view 1000 incidents through pagination. To see more, please adjust your search time range or use the Incident Query API to get all data.

​
Using Aggregate View

Aggregate view provides a different perspective for viewing incidents, where you can define different aggregation dimensions. The essence of aggregation dimensions is real-time Group By, such as viewing grouped by severity.
Aggregate View
After switching to aggregate view, a Grouping Rule selector appears at the top of the list:
  • Pick an existing rule: Click the dropdown to switch between all saved grouping rules under the current account. Each rule defines a set of Group By attributes (for example, by Severity + Channel + labels.service)
  • Create a rule: At the bottom of the dropdown, click New to select attributes, labels, and custom fields in the popup card, name the rule, and save it for future reuse
  • Edit or delete a rule: Hover over an existing rule to edit or delete it via the inline icons
  • Share a rule in a session: The selected rule’s view_id is reflected in the list URL parameter, making it easy to share the same perspective with other members
To improve performance, in aggregate view, the system matches at most 100 records for aggregation. Therefore, the list you see may not contain all matching data. If this concerns you, please switch to list view.

​
Using More Filters

Flashduty On-call provides filtering capabilities across various dimensions with ample flexibility. Typical scenarios include:
  • Search for incidents triggered by the “Host Down” alert policy based on check label
  • Search for incidents marked as “false positive” based on the false alarm field
Flexibility often means lower performance, and Flashduty On-call is no exception, despite our many performance optimizations. We always recommend narrowing your query time range and using conditions like Assigned to Me and Processing Progress to reduce query scope.

​
Row content

Beyond the title and progress, each incident row surfaces two key counters:
  • Associated alerts: total number of alerts grouped into this incident
  • Alert events: cumulative count of events merged into the incident. When a new event has been merged in the past 5 minutes, the merge icon turns orange to signal that the incident is still actively aggregating
Hovering over the counters opens a tooltip with the associated alert count, associated event count, and the relative time since the last merge.

​
Custom Rendering

Click the Settings button in the upper right corner of the incident list to customize display content and interaction behavior:

​
Incident Details

Incident details is the main entry point for investigating incidents, displaying all available information. Especially on the incident overview page, Flashduty On-call centrally displays the information you need most.
Incident Details Interface
Incident labels are displayed in the Details area of the details page. When an incident is aggregated from alerts produced by a monitoring integration (monit.alert) or a RUM integration (rum.alert), certain label values are rendered as deep links, letting you jump straight to the rule or issue that generated the alert: Jumping to an entity-tree rule requires contextual labels such as __entity_alert_account_id, __entity_alert_entity_definition_id, __entity_alert_data_source_id, and __entity_alert_policy_scope_group_id for locating; when any required label is missing or invalid, the label value is shown as plain text. Standalone alert rules (rule_id / __alert_rule_id) likewise require a positive integer value (e.g. 123); when the value is empty, 0, or non-numeric, the label is shown as plain text to avoid generating an invalid link. This deep-link capability also applies to the label area of the alert details page.

​
Detail Tabs

The incident details page contains 7 tabs; some appear only under certain conditions:

​
Action Item and Follow-Up Events

Every operation on action items and follow-ups is written to the timeline as an iconized record, displayed alongside comments, acknowledgments, and other events. The supported event types are:

​
Timeline Comments

The top of the Timeline tab provides a Markdown comment box that supports:
  • Writing notes, troubleshooting memos, or meeting summaries in Markdown syntax
  • Pasting or uploading images directly; screenshots are auto-uploaded and converted into image links
  • Clicking an image in a comment opens the original image in a new tab (no in-page preview)
  • Mentioning members with @ in a comment — the mentioned member receives a dedicated personal notification (with the comment content and an incident link, delivered by email and Flashduty App push by default), making it easy to pull the right people into the discussion
  • Appending the published comment as a record on the incident timeline, interleaved with system-generated events for easy retrospection
@mention notifications are dedicated personal notifications and are not affected by notification muting such as snooze or silence rules.
Posting a comment requires update permission on the incident. On the Timeline tab, the comment input box is always visible to all members, but only members with incident update permission see the Send button. On the incident overview page’s “Recent Timeline” section, the Leave Comment button and the comment input box it opens are likewise visible only to members with update permission.

​
Comment Types

Comments can carry a comment type tag to distinguish their nature on the timeline (for example, “root cause analysis” or “handling progress”):
  • When posting a comment, use the Comment type selector next to the comment box to assign a type, or choose No comment type; the timeline record shows the comment type as a colored tag
  • Comment types are configured at the account level and apply to all incidents under the current account; renaming or recoloring a type also affects historical comments
  • The selector next to the comment box only appears when the account already has comment types, or when you have comment-type management permission
Members with comment-type management permission (incidentCommentType:manage) can open the Manage comment types dialog from the selector and perform the following operations:
The operations and limits above (name up to 40 characters, 6 preset colors plus a custom picker, up to 10 types per account) apply to the Manage comment types dialog in the console. In the Flashduty App (mobile), the comment type selector behaves differently:
  • Types appear as pills above the comment box, with 3 types shown inline in a row and the rest collected into a More panel; the selected type is always kept in the inline row, and tapping it again deselects it
  • With management permission, you can create a type directly in the More panel: the name is limited to 20 characters, and the color picker offers 30 preset colors (6 common presets plus 24 palette colors); there is no custom color picker
  • Renaming, recoloring, deleting, and reordering must be done in the console

​
War Room Operations

If a war room has been created for the incident (requires enabling War Room in IM integration), the More menu on the action bar reveals two additional war-room management actions:
War-room management actions are only visible when a war room already exists for the current incident; the create action is still initiated by the Create War Room button on the action bar.
In the Flashduty App (mobile), war room behavior matches the console: the incident overview page shows a War room entry card (IM integrations with deep-link support open the chat directly; otherwise a dialog shows the group name to search for); Create war room lives in More Actions at the bottom, hidden when the incident already has a war room or is closed, and disabled with a toast when the incident has no responders; Add stakeholders to war room and Dissolve war room remain available after the incident is closed and do not depend on whether the IM integration is still enabled.

​
Post-Mortem

The incident details page has a built-in post-mortem editor, allowing you to complete the entire post-mortem workflow without leaving the page. The action area includes a shortcut button that navigates directly to the Post-Mortem tab. In the Post-Mortem tab, you can perform the following actions: See Post-Mortem for details.

​
Change History

The Change History tab shows change events correlated with the current incident in time, helping you quickly determine whether the root cause is related to a recent deployment or configuration change. The change event list displays the following information: You can adjust the query scope through the filter at the top, including time range and change source. Expand any row to view a timeline visualization of that change event, allowing comparison with the incident trigger time.

​
AI Summary

The incident details page supports one-click AI summary generation to help you quickly understand the full picture of an incident. Click the AI Summary button in the details area, and the system will automatically generate a structured summary based on the incident’s associated alerts (up to 20), including:
Plan requirement: This feature requires an On-call Pro or higher subscription. Learn more
  • Summary: A one-sentence description of what happened
  • Impacts: Key affected resources such as services, systems, environments, and instances
  • Actions: Immediately actionable investigation and remediation steps (up to 3)
You can choose from different AI models (default is DeepSeek V3; DeepSeek R1 is also available for deep thinking and reasoning capabilities) and regenerate as needed. The generated summary supports real-time streaming output and can be saved as the incident description.
AI Summary is only available for incidents automatically triggered by alerts. Manually created incidents do not support this feature.

​
Comprehensive Info Panel

The comprehensive info panel on the right side of the incident details page consolidates auxiliary information around the incident. From top to bottom:

​
FAQ

This error often appears on incident/alert list queries, analytics dashboards, etc. It’s mainly because the system matched too much data and the query timed out.In this case, please narrow your query scope, such as time range, or use more precise query conditions. If issues persist, please contact us.