Incidents | Docs

What is an Incident?

An incident is something to act on now. Only two things open one: a CRITICAL finding (including a warning that escalated to critical) and a site going DOWN. Critical findings on the same site join the open incident instead of opening another.

Note: Warnings never open an incident and are never linked to one. They stay on the findings list and the action plan, and new warnings are announced in the team's digest. If a warning escalates to critical, it opens or joins an incident at that moment.

Incident Lifecycle

Status	Meaning
OPEN	Active issue — a linked critical finding is still open, or the site is down
ACKNOWLEDGED	Team is aware and working on it
RESOLVED	Closed — see the reason below

Every closed incident records why it closed:

Reason	Meaning
findings_resolved	Every linked finding resolved
no_critical_finding	Findings are still open, but none is critical; the warnings stay on the findings list
recovered	The site answered again (uptime incidents)
manual	Someone resolved it by hand or through the API

Incidents auto-close when no critical finding is left open, and an hourly check closes any that were missed. A new critical finding after that opens a new incident.

Filtering on the Incidents page

The list is filtered by status using chips labeled Status → Active, Acknowledged, Resolved, or All. Active shows incidents in the OPEN state (same label on the row badge).

Deployment Correlation

Incidents automatically correlate with recent deployments (within a 20-minute window). If a deploy was recorded shortly before an incident opened, the incident shows which deployment likely caused it.

Tip: Set up the deploy webhook in Target → Settings → Deployments to enable automatic correlation.

AI Analysis

When AI enrichment is enabled, each incident gets:

AI Summary — Overview of what's happening across all linked findings
AI Root Cause — Likely cause based on the findings pattern
AI Triage Suggestion — Recommended next steps for resolution

Click Analyze with AI on any incident to trigger (or re-trigger) analysis.

Kloner Tasks Integration

When Kloner Tasks integration is configured, incidents can automatically create tasks for your development team to fix. Incidents show a Create k-task button (or display the linked task number if one already exists).

Task creation routes to the configured project + list
When the incident resolves, the linked task is automatically completed
New findings on an open incident add comments to the task