> For the complete documentation index, see [llms.txt](https://docs.widgelix.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.widgelix.com/events/incidents-and-escalation.md).

# Incidents & Escalation

How incidents are opened, escalated, acknowledged and resolved on the Events page.

When an Action that has an **Escalation Chain** fires, Widgelix opens an **incident** in addition to logging the event. The incident walks through the escalation steps until a person acknowledges it, and stays open until it is resolved.

The escalation itself (steps, recipients, acknowledgement timeouts, auto-resolve) is configured in the Action. See [Escalation Chain](/actions-formerly-rule-engine/escalation-chain.md). This page describes how you work with the resulting incidents.

## How escalation works

1. The Action’s condition is met and an incident is opened with status **Open**.
2. **Step 1**: the notification is sent to the user(s) of the first step. An acknowledgement deadline starts counting down.
3. If nobody acknowledges before the deadline, the incident moves to **Step 2** and the next recipients are notified, and so on.
4. When the last step has been reached, the incident is marked **Fully escalated**.
5. As soon as someone clicks **Acknowledge**, escalation stops and the incident is **assigned** to that user.
6. The incident is closed when a user clicks **Resolve**, or automatically when the condition clears if **auto-resolve** is enabled in the Action.

{% hint style="warning" %}
Acknowledging only stops escalation. The incident remains on the **Active** tab until it is resolved.
{% endhint %}

## Active incidents

![Active tab with escalation timeline expanded](https://2494440469-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fggsr9Xlsze5cwVr4WMof%2Fuploads%2F9Hq2uSAjaYjCs69ypU63%2Fevents-active.png?alt=media\&token=da47efd2-7250-4879-b3d1-fdd547209add)

The **Active** tab lists all open incidents. Columns:

| Column              | Description                                                                                                 |
| ------------------- | ----------------------------------------------------------------------------------------------------------- |
| **Incident**        | Severity icon, event message, the asset that triggered it and the Action name.                              |
| **Status**          | **Open** or **Resolved**.                                                                                   |
| **Escalation**      | Progress bar with the current step, e.g. “Step 2 of 3”, or **Fully escalated** when all steps are used up.  |
| **Ack deadline**    | Time left to acknowledge the current step, or how long the deadline is overdue (e.g. “overdue 3 h 12 min”). |
| **Acknowledged by** | “Assigned to *user*” once the incident has been acknowledged. Empty until then.                             |
| **Time**            | When the incident was opened.                                                                               |

Row actions:

* **Acknowledge**: take ownership. Escalation stops and the incident is assigned to you.
* **Resolve**: close the incident. It moves to the **Resolved** tab.

### Escalation timeline

Click an incident to expand it. You will see the full message and the escalation timeline: each step, the user(s) notified at that step and when the notification was sent (“Sent *time*”). Use it to see who has already been contacted and who is next.

## Resolved incidents

![Resolved tab](https://2494440469-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fggsr9Xlsze5cwVr4WMof%2Fuploads%2FWcWf0OKy3RY6kedY1ApU%2Fevents-resolved.png?alt=media\&token=570a6872-eb29-4dda-af9a-b0255ef0904f)

The **Resolved** tab shows closed incidents with the same columns. The status is **Resolved** and the row shows **Closed** instead of action buttons. **Acknowledged by** shows who took the incident (if anyone), which makes the tab useful for post-incident review.

## In-app pop-up

While you are signed in, a new incident also appears as a pop-up notification in the bottom corner of the app. It has two buttons:

* **Acknowledge**: acknowledge directly from the pop-up.
* **Open event**: go to the incident on the Events page.

## Good practice

* Acknowledge as soon as you start working on an incident, so colleagues on later steps aren’t paged unnecessarily.
* Resolve incidents once the cause is fixed. Unresolved incidents keep the sidebar badge and the Active counter up.
* Enable **auto-resolve** in the Action for conditions that clear on their own (e.g. a temperature returning to normal).
* Use the **Resolved** tab with a period and filters, then **Get report**, for weekly incident reviews.