> For the complete documentation index, see [llms.txt](https://docs.statuspal.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.statuspal.io/next/basics/incident-management.md).

# Incident Management

Incident Management is the internal workflow for coordinating your team's response to unplanned disruptions, separate from what your subscribers see.

Incident Management gives your team a structured way to handle disruptions: assign who is responsible, track severity, and follow step-by-step runbooks, all while keeping your status page updated for subscribers.

{% hint style="info" %}
**Incident Management is not the same as a status page incident notice.** A notice is the post your subscribers see on the status page. An incident is the internal record for your team's response. They work together, since updates published from an incident also appear on the linked notice, but they serve different audiences. See [Incident, Maintenance & Info Notices](/next/status-pages/incident-maintenance-and-info-notices.md) for notices.
{% endhint %}

<figure><img src="https://4089725725-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQG79S8GZWmqk3Plak6MO%2Fuploads%2Fgit-blob-c686dc1ef512d93cfe62618386323af41ef5a0ac%2Fbasics-incident-management-new.png?alt=media" alt="Declare incident form showing fields for title, status, description, affected service, severity, commander, and responders"><figcaption></figcaption></figure>

## Declaring an incident

Go to **Incident Management** → **Incidents** and click **Declare incident**. Each incident captures:

* **Title and description**: what happened and any initial context.
* **Status**: where the response stands, from Investigating through Identified and Monitoring to Resolved.
* **Affected service and status**: which of your incident management services is impacted and how severely: Operational, Degraded, Partial outage, or Unavailable.
* **Severity / business impact**: Minor, Major, or Critical, to communicate urgency across the team.
* **Commander**: the person leading the response.
* **Responders**: team members helping to resolve it.

Incidents can also be declared from Slack with the `/spal new` command, without leaving your workspace. See [Manage incidents](/next/incident-management/manage-incidents.md) for the full incident page, and [Configure incident management services](/next/incident-management/configure-incident-management-services.md) for the services you pick from.

## Slack integration

When your organization has connected a Slack workspace, StatusPal Next can create a dedicated channel per incident and invite the commander and all responders. This happens when the incident matches a runbook that has a **Slack step** configured; the channel is created as part of running that step.

{% hint style="info" %}
A Slack channel is only created automatically if your organization has Slack connected **and** the incident matches a runbook with a Slack step. Incidents without a matching runbook don't get a dedicated channel.
{% endhint %}

See [Respond from Slack](/next/incident-management/respond-from-slack.md) for connecting your workspace and working incidents from there.

## Runbooks

Runbooks are reusable, step-by-step response plans you define in advance. When an incident is declared, any runbook matching the incident's service and severity is triggered automatically, and team members check off steps as they work through the response. That gives structure during a high-pressure situation and a clear audit trail afterwards. Runbook steps can include Slack actions, such as creating the incident channel, and manual tasks.

## Roles

Members can declare incidents, post updates, resolve them, and complete runbook steps. Only **admins** can delete an incident.

Ready to try it? [Run your first incident drill](/next/incident-management/run-your-first-incident-drill.md).