Incident Types

Many different kinds of incidents can happen on any given day. Categorizing incidents by type and templating pre-filled values can save you time as you declare incidents. With incident types in FireHydrant, you can quickly declare an incident in Slack by doing nothing more than adding a name and selecting a type.

Creating a new incident type

Incident type creation page

Incident type creation page

Under Incident Response in the FireHydrant UI, click Incident Types. Click New in the top right corner of the page to create a new incident type.

This page is almost an exact mirror of the incident declaration page in the UI, which allows you to pick and choose which fields to pre-populate and with what data.

Best Practices

The only required data for a new incident type, like when declaring an incident, is a Name, but of course, this is underutilizing the capabilities of Incident Types. Here are some ideas:

  1. Impact: When you add impacted services, functionalities, and environments, it dramatically speeds up the process of declaring an incident. Additionally, your analytics in FireHydrant will be more consistent since templates guarantee that impacted component(s) will always be added.
  2. Severity: In line with impacted infrastructure, sometimes users may pre-determine how severe an incident is based on its type. For example, an issue where a "database is completely unresponsive" would likely constitute a severe incident, and this can be predetermined without needed input from responders.
  3. Description: The description has been used in multiple ways, from a pre-templated, general blurb about the type of issue this incident represents to a prompt to guide your responders with what to fill in when selecting this type.
  4. Runbooks: Often, different situations demand different automation, and you can specify this by pre-attaching certain Runbooks to incident types. This ensures that specific automation is kicked off.

Effective incident types help responders for your organization quickly categorize and select the right type for whatever issue they may face. This will vary according to the organization, but generally, FireHydrant recommends incident types that are not too generalized. For example:

  • ❌ "Infrastructure issues"
    • It seems very broad. Is it a database issue? Network traffic?
    • If almost all of your incidents can be categorized by the same incident type, then the type is too broad

Examples of incident types we have seen that work:

  • ✔️ "Database disk capacity issues"
    • This always pulls in the platform engineers and executes a Runbook with a Send a Webhook step to query current and remaining disk space from databases
  • ✔️ "UI Portal Issues"
    • This always pulls in the frontend engineering team to investigate what might be occurring, and they can pull in additional backend folks as needed if the contributing factors go deeper than HTML and Javascript
  • ✔️ "Investigation Incident"
    • This is an incident type FireHydrant uses for its incidents. If we've discovered some issues but are unsure whether it is an incident or what the exact impact is, we kick off initial investigation incidents, which assign a TRIAGE severity, create the incident Slack channel and pull on an on-call engineer to do initial exploration. Then, things can escalate from there as needed.

Using an incident type

FireHydrant supports using an incident type to create an incident in Slack and the web interface. By default, if any Incident Types exist, then you will see a dropdown for Incident Types on both the declaration modal in the UI and Slack.

Slack declaration form with incident type selection

Slack declaration form with incident type selection

Selecting a type will show all the preconfigured fields and data, allowing responders to edit/add more details if necessary.

Showing pre-filled fields when selecting a type

Showing pre-filled fields when selecting a type

To use incident types in the web interface, create a type and click the "Declare Incident" button. Incident types, if any exist, will appear as the first item in the Declare Incident form. Like Slack, selecting a type will show preconfigured fields with preconfigured values.

Hiding Incident Types

Don't use incident types? No problem. You can enable/disable Incident Types by visiting the Incident settings form where all of your other fields are configured, scrolling down, and unchecking "Incident types."

Extra settings in field configurations, including incident types.

Extra settings in field configurations, including incident types.

Next Steps