When an incident triggers, there are a number of manual actions you may wish to take, depending on your workflow or the specifics of the situation:

• Merge Incidents
• Snooze an Incident
• Edit Incident Title
• Edit Incident Urgency
• Edit Incident Duration
• Add a Note to an Incident
• Define Technical Service Dependencies

Merge Incidents

Merging more than one incident into a single incident streamlines the notification and resolution process. Merging incidents also allows you to consolidate alert information into a single incident, helping responders identify an issue’s root cause and impact.

🚧

Alert Maximum

An incident cannot have more than 1000 alerts. This means that you will not be able to merge incidents if their combined total exceeds 1000 alerts.

Merge Incidents in the Web App

There are two places to merge incidents in the web app:

• On the Incidents Page
• On an Incident’s Detail Page

On the Incidents Page

If there are two or more triggered incidents on the Incidents page, you can merge them into a single incident. When you merge incidents, they will appear as a single incident with multiple alerts.

1. On the web app’s Incidents page, select the checkboxes next to the incidents you’d like to merge together.
2. Click Merge Incidents.

3. In the modal, select which incident you would like alerts to be grouped under.
   • In the field Select the incident to merge into, you can sort by Selected Incidents, Assigned to me, or Assigned to my team. After selecting an incident, you can optionally update the Incident Title, if a different title would more accurately describe the issue.
4. Click Merge incidents and [X] Alerts.

The incident dashboard will then show a single incident. When you select the incident to view its detail screen, you can review alerts from all incidents you selected in step 1 under the Alerts section.

On an Incident’s Detail Page

You can also merge incidents on an incident’s details page:

1. Select an incident to view its details page, then click More Merge with Another Incident.
2. Enter an incident number and click Find Incident.
3. Click Merge Incident and [X] Alerts.

Merge Incidents in the Mobile App

1. On the Open Incidents screen, tap the in the top right and tap Select Incidents.
2. Select the radio buttons to the left of the incidents you would like to merge, tap the again and then select Merge.
3. Select the incident that you would like to merge into. You will see a confirmation dialog at the bottom of the screen stating that the incidents have been merged.

Merge Behavior

• When you merge multiple incidents together, alerts will be consolidated into the target incident. The other selected incidents will be resolved, with the resolution reason listed as Merged. These incidents will reference the target incident that you selected in the merge dialog.

• The deduplication key, called the Alert Key, will not be changed, but it will move so that it is under a single incident with other deduplication keys.
• If you are using a bidirectional integration, such as the Slack integration, merged incidents will display as resolved and reference the new target incident where all alerts are aggregated.

• Responders from source incidents will not be merged into the target incident. Instead, the target incident’s responders are preserved and all alerts will be assigned to them. These users may be viewed under the Timeline tab on the incident's page.
• Subscribers from source incidents will not be merged into the target incident. They will need to be re-added to the target incident.

Move Alerts to Another Incident

If an alert is incorrectly merged, there are two ways to move alerts either to a new or existing incident:

• On the Incident’s Page
• On an Alert’s Page

On the Incident’s Page

You can move an alert to another incident on an incident’s details page in the web app:

1. Navigate to an incident’s detail page scroll to the Alerts section.
2. Next to the alert that you’d like to move, select Move to a new incident or Move to an existing incident.

3. Confirm your selection in the modal that appears.

On an Alert’s Page

You may also move an alert to another incident on an alert’s details page in the web app:

1. Navigate to an incident’s detail page in the Alerts section, click an alert’s Summary to navigate to its details page.
2. Click Move to Another Incident.

3. Enter an incident number and click Find Incident.
4. Click Move Alert.

Merged Incidents and Webhooks

If you have configured webhooks, merging alerts into another incident will send a webhook for the source incident with a resolve_reason of merged.

Webhooks will continue to update the target incident, but all incidents that were merged into the target incident will be updated as resolved.

Likewise, webhook updates will only continue to be sent for services with open incidents (i.e., triggered or acknowledged). For example, if an incident from Service A is merged into an incident on Service B, only webhooks on Service B will continue to be sent.

For incidents that were resolved when they merged into a target incident, resolve webhooks will trigger (if configured). These incidents will contain a reference to the target incident. In the webhook body, the resolve_reason object will detail information about the target incident and indicate that the type is merge_resolve_reason.

Snooze an Incident

Responders can use the snooze feature to keep an acknowledged incident from escalating while they’re working on the issue. Users can snooze an incident for the following time intervals: 1 hour, 4 hours, 8 hours, 24 hours or Other. If you choose Other, the maximum length is 168 hours (i.e., a week).

Snooze is only available for acknowledged incidents. If a user does not resolve the incident before the snooze timer expires, the incident will return to a triggered state and will begin notifying the user again according to their notification rules. If a different user has come on call since the incident triggered (due to a rotation on a schedule, for example), both users will be notified.

The incident log will capture all snooze actions taken on an incident.

You can snooze an incident from either the web app or mobile app.

In the Web App

1. Acknowledge the incident. Acknowledge will be replaced with Snooze.
2. Select Snooze and the length of time you’d like to snooze the incident.

📘

Add an Escalation Policy as a Responder

If a user adds responders to an incident and selects an escalation policy, snoozing will not prevent the incident from escalating.

If a user selects Other, they will have the option to select a custom snooze time, snooze until a time tomorrow, or base your snooze on a service’s support hours.

In the Mobile App

1. Acknowledge the incident. Acknowledge will be replaced with Snooze.
2. Select Snooze and the length of time you’d like to snooze the incident:
   • 1 hour
   • 4 hours
   • 24 hours
   • for
   • until

Reassign a Snoozed Incident

Reassigning a snoozed incident will cancel the snooze timer. The acknowledgement timeout will reset to the triggering service’s default value.

Acknowledge a Snoozed Incident

If another user acknowledges a snoozed incident, the incident exits the snoozed state and the acknowledgement timeout starts fresh.

Auto-Resolution and Snooze

Services can be configured to automatically resolve an incident after a predetermined period of time passes — this is called auto-resolution. If an incident is snoozed past the time when auto-resolution would have resolved the incident (for example, auto-resolution is configured to resolve incidents after six hours, but the incident is snoozed for 12 hours), the incident will remain snoozed and not automatically resolve. Additionally, when an incident returns to an acknowledged or triggered state, the auto-resolution timer resets.

Edit Incident Title

It’s possible you’ll need to change an incident’s title as it progresses or as the nature of the underlying issue becomes more clear.

Edit Incident Title in the Web App

1. Select an incident’s Title to navigate to its details page.
2. To the right of the incident’s title, click Edit.
3. Update the title.
4. Click Save.

Edit Incident Title in the Mobile App

1. Select an incident to navigate to its details page.
2. With the Triage tab selected, tap Edit Title.
3. Enter a new title.
4. Tap Save.

Edit Incident Urgency

If it becomes clear during the course of an incident that it should have a different urgency, responders can edit the urgency.

🚧

Editing Urgency Unacknowledges Incidents

If an incident is acknowledged and then its urgency is edited from low to high, then the incident will be unacknowledged. Escalation will then continue notifying responders using their high-urgency notification rules.

Edit Incident Urgency in the Web App

1. Select an incident’s Title to navigate to its details page.
2. Next to Urgency, click the dropdown and select High or Low.

Edit Incident Urgency in the Mobile App

1. Select an incident to navigate to its details page.
2. With the Triage tab selected, tap Change to Low/High Urgency.
3. Confirm your selection by tapping Change Urgency.

Edit Incident Duration

📘

Incident Status Requirement and Pricing Plan Availability

You can edit an incident’s duration once it is resolved. This feature is not available while an incident is triggered or acknowledged.

Accounts on all pricing plans are able to edit a resolved incident's duration. Adjusted incident durations can be viewed in Insights reports in the User Defined Response Effort. When this value is edited, it replaces the original Response Effort value for the incident, and is used for the Total response effort values seen in the Service Performance, Team, and Escalation Policy Insights reports.

PagerDuty tracks incident duration (how long it took to resolve an incident) in order to calculate metrics, such as Response Effort and MTTR (Mean Time To Resolve).

Sometimes the actual effort you spent on an incident may be different from the amount of time it was open. In order to provide more accurate metrics in your Intelligent Dashboards, you can adjust the incident duration to reflect the actual response effort that was required to resolve an incident. Note: The User Defined Effort metric in the Incident Activity (Incidents List) report does reflect adjusted incident duration times.

To edit the duration of a resolved incident, in the web app:

1. On an incident’s details page, click under Duration at the top right of the incident details page.

2. In the modal, enter in the Actual effort time that was required to resolve the incident in the following format: xd xh xm.
3. Click Update Incident.

📘

Edited Incident Durations in Insights Reports

The Insights feature will calculate Response Effort in the Service Performance, Team, and Escalation Policy reports using the edited incident duration, if it exists.

The Responder report does not use edited incident durations, since response efforts in this report are calculated on a responder level, not the incident level.

Add a Note to an Incident

Incident notes help responders resolve incidents faster by adding relevant information or links. Notes can be useful for teams responding to active incidents, and they can add helpful context for later reference. Users can add notes to open and resolved incidents.

🚧

Limitations

The following limitations apply to both open and resolved incidents:

• Users can add up to 2,000 notes to an incident. Additionally, incident notes are limited to 65,535 single-byte characters.
• Once added, notes cannot be edited or deleted.

Add a Note in the Web App

1. On the Incidents page, select an incident’s Title to navigate to its details page.
2. In the Notes section on the right-hand side, enter a note in the text field and click Add Note.

Add a Note in the Mobile App

1. Navigate to either Open Incidents or Resolved Incidents select an incident to navigate to its details screen.
2. On iOS, tap More at the bottom of the screen. On Android, tap the menu icon in the top right corner.
3. Select Add Note.

4. Enter the text for your note and tap Post Note.

Add a Note Via Event Orchestration

📘

Availability

Adding notes using escalation policy is available as part of Advanced Event Orchestration. Please contact our Sales team if you are interested in changing your pricing tier.

You can automate adding notes to incident as part of Event Orchestration. While configuring a Global or Service Orchestration Rule, select the Incident Data tab and enter your desired text in the section Add incident note.

Like manually added notes, notes that are added as the result of an orchestration rule will appear on an incident's detail page under the Notes section. Notes added by Event Orchestration will show An Orchestration Event Rule as the note’s author.

Add a Note Via Event Rules

❗️

Rulesets End-of-Life

Rulesets and Event Rules will end-of-life on January 31, 2025. We recommend using Event Orchestration to add notes instead, which also offers new functionality, such as improved UI, rule creation, APIs and Terraform support, advanced conditions, and rule nesting.

📘

Availability

Adding notes using event rules is available on our Business, Enterprise for Incident Management and Digital Operations (Legacy) plans.

You can use event rules workflows, part of the Rulesets feature, to add notes to incidents. While configuring an event rule, in the section Additional Context, enter text for a note, which will be added to every incident that triggers as a result of the event rule.

Like manually added notes, notes that are added as the result of an event rule will appear in the incident timeline. Notes added by an event rule will list A Global Event Rule as the note’s author.

Define Technical Service Dependencies

Service dependency data equips users with a broader understanding of the environment surrounding their incident, allowing them to identify the root cause more efficiently. When a service is experiencing an incident, and that service has dependencies defined, relevant service dependency data will be available on the incident details page. If the service does not yet have dependencies defined, or is missing possible dependencies, responders will be able to view suggested dependencies, and easily add them.

View Technical Service Dependencies in an Incident

To view the impacted service’s Technical Service Dependencies, click an incident’s Title to view the incident details page. You will see the Technical Service Dependencies section on the right, below Notes.

Each dependency will have the following details:

• Service Name
• Status: Open Incidents or Operational (no open incidents).

If you click the dependency’s Service Name, you will be able to see more granular details:

• On Call Now: Responder(s) currently on call for the service.
• Open Incidents: A list of current open incident(s) on the service.

Suggested Technical Service Dependencies in an Incident

If incidents on your service tend to be followed by incidents on another service, or vice versa, suggested technical service dependencies will also be provided. If available, they will be listed under a Suggested header with next to the service’s name:

To add a Suggested Service Dependency, click the service name Add, next to Add this service as a dependency?.

Add Technical Service Dependencies From an Incident

1. Click an incident’s Title to view the incident details page. You will see the Technical Service Dependencies section on the right, below Notes.
2. Click Add Service Dependency.
3. You will be directed to the service’s Service Dependencies page.
   • There are two sections to this page: other services that this service uses or is used by. Click Edit Services to add the appropriate dependency.
4. On the Edit Services screen, you may search by service name, or select one of the Business Services or Technical Services tabs. Click to add the desired services; you may add multiple business and technical services. Optional: You may also create a new business or technical service on this screen by clicking Create a new business service or Create a new technical service from the corresponding tabs. This will open the Business Service or Technical Service configuration screen in a new tab.
5. Click Save Changes.