Incident Types

Many different kinds of incidents can happen on any given day. Categorizing incidents by type and templating pre-filled values can save you time as you declare incidents. With incident types in FireHydrant, your responders can quickly declare an incident by selecting a type, which pre-populates fields. From there, users can modify the pre-filled values or immediately declare.

Creating a new incident type

Under Incident Response in the FireHydrant UI, click Incident Types. Click New in the top right corner of the page to create a new incident type.

This page is almost an exact mirror of the incident declaration page, which allows you to pick and choose which fields to pre-populate and with what data. For an overview of all incident fields, see Incident Fields or configure Incident Custom Fields.

The only additional field here is Incident type name, which is the name you provide for this incident type. When users select an incident type from the dropdown while declaring, this is the name they will see.

Best Practices

The only required data for a new incident type, like when declaring an incident, is a Name, but of course, this is underutilizing the capabilities of Incident Types. Here are some ideas:

1. Impact: When you add impacted services, functionalities, and environments, it dramatically speeds up the process of declaring an incident. Additionally, your analytics in FireHydrant will be more consistent since templates guarantee that impacted component(s) will always be added.
2. Severity: In line with impacted infrastructure, sometimes users may pre-determine how severe an incident is based on its type. For example, an issue where a "database is completely unresponsive" would likely constitute a severe incident, and this can be predetermined without needed input from responders.
3. Description: The description has been used in multiple ways, from a pre-templated, general blurb about the type of issue this incident represents to a prompt to guide your responders with what to fill in when selecting this type.
4. Runbooks: Often, different situations demand different automation, and you can specify this by pre-attaching certain Runbooks to incident types. This ensures that specific automation is kicked off.

Effective incident types help responders for your organization quickly categorize and select the right type for whatever issue they may face. This will vary according to the organization, but generally, FireHydrant recommends incident types that are not too generalized. For example:

• ❌ "Infrastructure issues"
  • It seems very broad. Is it a database issue? Network traffic?
  • If almost all of your incidents can be categorized by the same incident type, then the type is too broad

Examples of incident types we have seen that work:

• ✔️ "Database disk capacity issues"
  • This always pulls in the platform engineers and executes a Runbook with a Send a Webhook step to query current and remaining disk space from databases
• ✔️ "UI Portal Issues"
  • This always pulls in the frontend engineering team to investigate what might be occurring, and they can pull in additional backend folks as needed if the contributing factors go deeper than HTML and Javascript
• ✔️ "Investigation Incident"
  • This is an incident type FireHydrant uses for its incidents. If we've discovered some issues but are unsure whether it is an incident or what the exact impact is, we kick off initial investigation incidents, which assign a TRIAGE severity, create the incident Slack channel and pull on an on-call engineer to do initial exploration. Then, things can escalate from there as needed.

Using an incident type

FireHydrant supports using an incident type to create an incident in Slack and the web interface. By default, if any Incident Types exist, then you will see a dropdown for Incident Types on both the declaration modal in the UI and Slack.

Selecting a type will show all the preconfigured fields and data, allowing responders to edit/add more details if necessary.

To use incident types in the web interface, create a type and click the "Declare Incident" button. Incident types, if any exist, will appear as the first item in the Declare Incident form. Like Slack, selecting a type will show preconfigured fields with preconfigured values.

Hiding Incident Types

Don't use incident types? No problem. You can enable/disable Incident Types by visiting the Incident settings form where all of your other fields are configured, scrolling down, and unchecking "Incident types."

Next Steps

• Learn more about Runbooks, the powerful automation engine underneath the hood of FireHydrant
• Customize your Incident Fields as well as Custom Fields
• Look at configuring Severities and Priorities as well as Service Catalog Conditions