When an incident triggers, there are a number of manual actions you may want to take, depending on your workflow or the specifics of the situation:

• Merge Incidents
• Snooze an Incident
• Edit Incident Title
• Edit Incident Priority
• Edit Incident Urgency
• Reassign an Incident's Service
• Edit Incident Duration
• Add a Note to an Incident

Merge Incidents

Merging multiple incidents into a single incident streamlines the notification and resolution process. Merging incidents also consolidates alert information into a single incident, helping responders identify an issue’s root cause and impact.

Merge Incidents Using Web App

There are two places to merge incidents in the web app:

• On the Incidents Page
• On an Incident’s Details Page
• On a Service's Details Page

On the Incidents Page

If there are two or more triggered incidents on the Incidents page, you can merge them into a single incident. When you merge incidents, they appear as a single incident with multiple alerts.

1. On the web app’s Incidents page, select the checkboxes next to the incidents you want to merge.
2. Click Merge Incidents.
3. In the modal, select the incident you want to group the alerts under.
   In the Select the incident to merge into field, sort the incidents by Selected Incidents, Assigned to me, or Assigned to my team.
4. (Optional) Update the Incident Title if a different title would better describe the issue.
5. Click Merge incidents and [X] Alerts.

The incident dashboard shows the merged incident. When you select the incident to view its detail screen, you can review alerts from all incidents you selected in step 1 under the Alerts section.

On an Incident’s Details Page

You can also merge incidents on an incident’s details page:

1. Select an incident to view its details page.
2. Click More Merge with Another Incident.
3. Enter an incident number and click Find Incident.
4. Click Merge Incident and [X] Alerts.

On a Service's Details Page

You can also merge incidents on a service’s details page:

1. Navigate to Services Service Directory.
2. Select the service to view its details page and merge incidents.
3. Select the checkboxes next to the incidents you want to merge.
4. Click Merge Incidents.
5. In the Merge Incidents modal, select the radio button of the incident you want to merge into.
6. Click Merge. The remaining selected incident(s) are resolved after the merge is complete.

Merge Incidents Using Mobile App

1. On the Open Incidents screen, tap (iOS) / (Android) in the top right and tap Select Incidents.
2. Select the radio buttons to the left of the incidents you want to merge and tap Change (X) Merge X incidents (iOS) or Merge (Android).
3. Select the incident that you want to merge into. A confirmation dialog appears at the bottom of the screen, indicating that the incidents have been merged.

🚧

Alert Maximum

An incident cannot have more than 1,000 alerts. This means that you cannot merge incidents if their combined total exceeds 1,000 alerts.

Merge Behavior

• When you merge multiple incidents together, alerts are consolidated into the target incident. The other selected incidents are resolved, with the resolution reason listed as Merged. These incidents reference the target incident that you selected in the Merge dialog.

• The deduplication key, called the Alert Key, does not change, but it moves so that it is under a single incident with other deduplication keys.
• If you are using a bidirectional integration, such as the Slack integration, merged incidents appear as resolved and reference the new target incident, where all alerts are aggregated.

• Responders from source incidents will not be merged into the target incident. Instead, the target incident’s responders are preserved, and all alerts will be assigned to them. You can view these users in the Timeline tab on the incident's details page.
• Subscribers from source incidents are not merged into the target incident. They must be re-added to the target incident.

Move Alerts to Another Incident

If an alert is incorrectly merged, there are two ways to move alerts either to a new or existing incident:

On the Incident’s Page

You can move an alert to another incident on an incident’s details page in the web app:

1. Navigate to an incident’s detail page and scroll to the Alerts section.
2. Select the checkbox of the alert you want to move.
3. In the Move dropdown, select Create new incident.

4. (Optional) Click Edit Incident if you want to edit the incident details.
5. Click Create Incident.

On an Alert’s Page

You can also move an alert to another incident on an alert’s details page in the web app:

1. Navigate to an incident’s detail page.
2. In the Alerts section, click an alert’s Summary to navigate to its details page.
3. Click Move to Another Incident.

3. Enter an incident number and click Find Incident.
4. Click Move Alert.

Merged Incidents and Webhooks

If you have configured webhooks, merging alerts into another incident sends a webhook for the source incident with a resolve_reason of merged.

Webhooks continue to update the target incident, but all incidents merged into it are marked as resolved.

Similarly, webhook updates are only sent for services with open incidents. For example, if you merge an incident from Service A into an incident on Service B, updates on only Service B webhooks continue to be sent.

For incidents that were resolved when they merged into a target incident, resolve webhooks will trigger, if configured. These incidents contain a reference to the target incident. In the webhook body, the resolve_reason object provides detailed information about the target incident and indicates that the type is merge_resolve_reason.

Snooze an Incident

Responders can use the snooze feature to prevent an acknowledged incident from escalating while they are working on the issue. You can snooze an incident for the following time intervals: 1 hour, 4 hours, 8 hours, 24 hours, or Other. If you choose Other, the maximum length is 168 hours (i.e., one week).

Snooze is only available for acknowledged incidents. If you do not resolve the incident before the snooze timer expires, the incident returns to a triggered state and notifies you again according to your notification rules. If a different user has come on call since the incident was triggered (e.g., due to a rotation on a schedule), both users are notified.

The incident log captures all snooze actions taken on an incident. You can snooze an incident in two ways:

Snooze an Incident in the Web App

1. Acknowledge the incident. Acknowledge replaces Snooze.
2. Select Snooze and enter the length of time you want to snooze the incident.

📘

Add an Escalation Policy as a Responder

If you add responders to an incident and select an escalation policy, snoozing does not prevent the incident from escalating.

If you select Other, you can select a custom snooze time, snooze until a time tomorrow, or base your snooze on a service’s support hours.

Snooze an Incident in the Mobile App

1. Acknowledge the incident. Acknowledge replaces Snooze.
2. Select Snooze and the length of time you want to snooze the incident:
   • 1 hour
   • 4 hours
   • 24 hours
   • for
   • until

Reassign a Snoozed Incident

Reassigning a snoozed incident cancels the snooze timer. The acknowledgement timeout resets to the triggering service’s default value.

Acknowledge a Snoozed Incident

If another user acknowledges a snoozed incident, the incident exits the snoozed state and the acknowledgement timeout resets.

Auto-Resolution and Snooze

You can configure services to automatically resolve an incident after a predetermined period of time passes — this is called auto-resolution. If an incident is snoozed past the time when auto-resolution would have resolved it (e.g., auto-resolution is configured to resolve incidents after six hours, but the incident is snoozed for 12 hours), the incident remains snoozed and does not automatically resolve. Additionally, when an incident returns to an acknowledged or triggered state, the auto-resolution timer resets.

Edit Incident Title

You can change an incident’s title as it progresses or as the underlying issue becomes clearer. You can edit an incident in two ways:

Edit Incident in the Web App

1. Select an incident’s Title to navigate to its details page.
2. Click Editon the right of the incident’s title.
3. Update the title.
4. Click Save.

Edit Incident in the Mobile App

1. Select an incident to navigate to its details page.
2. With the Triage tab selected, tap Edit Title.
3. Enter a new title.
4. Tap Save.

Edit Incident Priority

Incident Priority indicates an incident's relative importance (e.g., P-1, P-2). You can adjust an incident's priority if its impact grows or shrinks during the course of response, for example. Refer to Incident Priority for more information.

Edit Incident Urgency

If it becomes clear during the course of an incident that the urgency should change, you can edit it.

Edit Incident Urgency in the Web App

1. Select an incident’s Title to navigate to its details page.
2. Click the Urgency dropdown and select High or Low.

Edit Incident Urgency in the Mobile App

1. Select an incident to navigate to its details page.
2. With the Triage tab selected, tap Change to Low/High Urgency.
3. Confirm your selection by tapping Change Urgency.

🚧

Editing Urgency Unacknowledged Incidents

If you acknowledge an incident and change its urgency from low to high, it goes back to an unacknowledged state. Escalation then continues, notifying responders using their high-urgency notification rules.

Reassign an Incident's Service

Every PagerDuty incident has the following:

• Main Service: Represents the technical service the incident is assigned to. You can change an incident's main service by reassigning the incident to a different service.
• Impacted Services: Represents services that are included in an incident’s alert grouping. You cannot manually change or reassign these services.

A service is automatically included as an impacted service when one of the three following actions occurs:

• Merging incidents that were created across multiple services into a single incident.
• Globally grouping alerts across multiple services into a single incident.
• Reassigning an incident's service. To ensure alert grouping continues after the reassignment across services, the alert group (including the alert key or deduplication key) does not change. The original service will remain as an impacted service due to alerts from the original service feeding into the incident.

📘

Service Reassignment

Consider the following when assigning an incident to a different service:

• Acknowledged incidents will return to a triggered state.
• If the new service uses a different escalation policy, the current incident’s assignee is removed from the incident and replaced with the on-call responder from the new service.
• Incident Roles, Incident Tasks, Custom Fields, and Incident Workflows are not altered.
• After reassigning the incident to a new service, the incident continues to participate in Alert Grouping based on the originating service’s alert grouping settings.
• A record of the reassignment appears in the incident's timeline, including the originating service and user who made the change.

You can assign an incident to a different service in the following locations:

Reassigning an Incident in the Web App

Incident Details Page:

1. Navigate to the Incidents page and click an incident's title to view its details.
2. In the Main Service field, click .

3. In the Change Service modal, select a service from the dropdown.
4. Click Change Service.

Operations Console:

📘

Availability

The Operations Console is available with the PagerDuty AIOps add-on. If you want to sign up for a trial of PagerDuty AIOps features, please read PagerDuty AIOps Trials.

1. Navigate to AIOps Operations Console.
2. Click the Incident Title or Alert to open up the side panel.
3. In the Main Service field, click Edit to the right of the service’s name.
4. In the modal window, select a different service from the dropdown.
5. Click Change Service.

Reassigning an Incident in the Mobile App

1. Navigate to Incidents.
2. Tap on an incident to view its details page.
3. In the Triage tab, scroll left in the incident actions carousel and tap Change Service.
4. Tap a service to select. You may select a service from the My Teams tab or All services tab. A confirmation modal appears.
5. Tap Confirm to reassign the incident to the new service.

Reassigning an Incident in ServiceNow

🚧

Prerequisites

• The Service Reassignment feature is available with ServiceNow 8.2. Upgrade to the latest version to realize the full feature value.
• To configure Service Reassignment, refer to Sync Service Reassignment with ServiceNow.

With ServiceNow 8.2, the Service Reassignment feature enables bidirectional sync between ServiceNow and PagerDuty when incidents are reassigned to different Configuration Items (CIs) in ServiceNow or to different services in PagerDuty.

To learn how to reassign in both systems, refer to the following documentation:

• ServiceNow: Associate CIs with Incident
• PagerDuty: Reassign an Incident's Service

🚧

Service Reassign Unavailability in Certain Integrations

Service reassignment is not available for Jira Cloud, Jira Server, or Zendesk integrations. If you reassign a linked PagerDuty incident to a different Technical Service, the incident remains linked to the issue or ticket, but synchronization rules tied to the original Technical Service no longer apply.

Edit Incident Duration

📘

Incident Status Requirement and Pricing Plan Availability

You can edit an incident’s duration once it is resolved. This feature is not available while an incident is triggered or acknowledged.

Accounts on all pricing plans can edit the duration of a resolved incident. You can view adjusted incident durations in Insights reports when you add the User Defined Response Effort column to your table view. When you edit this value, it replaces the original Response Effort value, and is used for the Total response effort values observed in the Service Performance, Team, and Escalation Policy Insights reports.

PagerDuty tracks incident duration (how long it took to resolve an incident) to calculate metrics, such as Response Effort and MTTR (Mean Time To Resolve).

Sometimes, the actual effort you spent on an incident may differ from the total time it was open. To provide more accurate metrics in your Intelligent Dashboards, you can adjust the incident duration to reflect the actual response effort required to resolve an incident.

📘

Note

The User Defined Effort metric in the Incident Activity (Incidents List) report does reflect adjusted incident duration times.

Edit Incident Duration in the Web App

1. On a resolved incident’s details page, click under Duration.

2. In the Update Incident Times modal, enter the Actual effort time that was required to resolve the incident in the following format: xd xh xm.
3. Click Update Incident.

📘

Edited Incident Durations in Insights Reports

The Insights feature calculates Response Effort in the Service Performance, Team, and Escalation Policy reports using the edited incident duration, if it exists.

The Responder report does not use edited incident durations, as response efforts are calculated based on responder activity rather than incident activity.

Add a Note to an Incident

Incident notes help responders resolve incidents faster by adding relevant information or links. Notes are useful for teams responding to active incidents, and they can add helpful context for later reference. You can add notes to open and resolved incidents.

🚧

Incident Note Limitations

The following limitations apply to notes on both open and resolved incidents:

• An incident can have up to 2,000 notes.
• Incident notes are limited to 65,535 single-byte characters. This typically equates to ~16,000 characters of UTF-8 encoded text.

Add a Note Using the Web App

1. On the Incidents page, select an incident’s Title to navigate to its details page.
2. In the Notes section on the right-hand side, enter a note in the text field and click Add Note.
3. To edit or delete a note, open the more actions (…) menu next to the note.

Add a Note Using the Mobile App

1. Navigate to either Open Incidents or Resolved Incidents select an incident to navigate to its details screen.
2. On iOS, tap More at the bottom of the screen and tap Add Note.
   On Android, under the Triage tab, tap Add Note.

4. Enter the text for your note and tap Post Note.

Add a Note in Incident Workflows

Incident Workflows allow you to automate your incident response processes. The following Workflow Actions add incident notes to your workflows:

• Add Note to an Incident
• Prompt to Add a Note to the Incident (Slack)

Add a Note in Event Orchestration

📘

Availability

Adding notes using Event Orchestration is available inAdvanced Event Orchestration. Contact the Sales team if you are interested in changing your pricing tier.

You can automate adding notes to incidents as part of Event Orchestration. While configuring a Global or Service Orchestration Rule, select the Incident Data tab and enter your desired text in the section Add incident note.

Similar to manually added notes, notes that are added as the result of an orchestration rule appear on an incident's detail page under the Notes section. Notes added by Event Orchestration displays An Orchestration Event Rule as the note’s author.