Running an incident from the dashboard

The dashboard is not a read-only view of what happened in Slack. You can declare an incident from the incidents list, and run it from its own page, using the same dialogs Firefight asks for in Slack. Which surface you use is a matter of where you already are.

On an incident’s page the controls sit in two places. Things that are a property of the incident are edited where they are shown, so you click the thing you want to change. Things that move the incident from one state to another live in the ⋮ menu at the top right, next to the channel link.

The page stays up to date

You never need to refresh an incident’s page. A lead assigned in Slack, a status set over the API, an action Halon adds or a change someone makes in another tab shows on the page as soon as it is saved. A dialog you are filling in, or a picker you have open, keeps what you typed while the page around it changes.

Declaring an incident

Declare incident, in the header of the Incidents page, opens your workspace’s Declare form, the same one /ff new opens in Slack, so it asks for the same fields including any custom ones.

Firefight creates the incident channel straight after, which takes a moment. Until it exists, the channel button on the incident’s page is greyed out and shows the name the channel is about to get. If it stays greyed out, creating the channel failed.

Change severity or status

Click the severity or the status badge at the top of the page. Both open the Post an update dialog with the incident’s current values filled in.

They open the whole dialog rather than a short list because that is what your workspace configured. If the Update form asks for a written message, or for a custom field, it asks for it here too. That is the same dialog /ff update, /ff status and /ff severity open in Slack, so an update posted from the dashboard reads the same in the channel and records the same timeline entry.

The written message keeps its shape wherever you post it from. Start a line with a dash to make a bullet, leave a blank line between paragraphs, and paste links as they are. The incident’s timeline and the update in Slack both show the list, the paragraphs and clickable links.

Assign the lead and the other roles

Click the person under Lead, or the person next to any role in the Roles panel. Both are dropdowns of everyone in the workspace.

Every configured role is listed whether or not anyone holds it, so a role nobody has taken yet can be filled here. Picking Unassigned clears a role. The incident lead is the one exception and cannot be cleared, only handed to someone else, so the incident always has someone accountable. Each change announces itself in the incident channel exactly as /ff lead and /ff roles do.

Resolve, cancel and reopen

Open the ⋮ menu.

Action	What happens
Post an update	The Update dialog, the same as clicking a badge.
Resolve incident	The Resolve dialog. Closes the incident, which is what makes a postmortem available.
Cancel incident	The Cancel dialog. The incident stays with its channel and timeline, but never counts as resolved.
Reopen incident	Only on an incident that is already over. Asks for a reason, which is optional as it is in Slack, then puts the incident back on your default live status. The reason shows on the timeline and in the incident channel’s reopen message.

On an incident that is over, the menu offers only Reopen incident and the two ways to link incidents.

Resolve and Cancel ask what your workspace’s Resolve and Cancel forms ask, which may include custom fields. If you have more than one status in the Closed or Canceled stage, they ask which one applies. If you have only one, they do not, because there is nothing to choose. See Statuses, severities & types.

An incident that is over stops offering the badges and the role pickers, because every one of those changes announces itself in a channel that may already be archived. Reopen it first. It also stops taking new actions, and its runbook steps can no longer be claimed, because both are work during the incident. Follow-ups can still be added, since they are the work that comes after.

Work the action items

The + on the Actions and Follow-ups panels opens Add Action Item, where you describe the work and can assign it to someone. Once the incident is over, the Actions + is greyed out with a tooltip pointing you to a follow-up instead.

Every action and follow-up in the sidebar has a menu on hover.

• Pick up takes an unclaimed item and marks it in progress. It appears only while nobody holds it.
• Mark done completes it.
• Rename changes what it says needs doing, in a dialog. A title can be up to 3,000 characters, and the dialog says so under the field when it is longer.
• Unassign lets go of it, so nobody holds it and it is open again. It appears only while someone holds it.
• Reopen, on an item that is done, opens it again for whoever held it. An action stays done once the incident is over, so reopen the incident first. A follow-up can always be reopened.
• Assign to hands it to anyone in the workspace.

An action or follow-up that tracks an issue in your issue tracker shows the issue’s key after its status, such as FIR-105. Click it to open the issue in a new tab. The same link appears on the item’s message in the incident channel. When Halon opens an issue in a chat about the incident, it adds the issue here by itself, as an action for work during the incident or a follow-up for work after it, and marks it done when it closes the issue.

When your workspace keeps items in step with an issue tracker, an item without an issue offers Create issue next to its status, and once it has one, changes to the item and to the issue reach each other. See Issue tracking.

Taking an item yourself and handing it to someone else are different things. Taking your own work is silent, because you already know. A handover posts in the incident channel, so the person finds out.

Claim a runbook step

Expand a runbook in the Runbooks panel to see its steps, who is on each one, and which are done. Claim on a step nobody holds yet takes it, which creates the action item behind that step and puts it in the sidebar alongside everything else. To hand a step that someone holds to another person, use Assign to on its action item.

Once the incident is over, Claim is greyed out and hovering it says why. The + at the top of the panel attaches another runbook, the same as /ff runbook in Slack.

Link incidents together

The ⋮ menu also carries the two relationships.

Link to an incident records that two incidents are related. Both name the other on their timelines and neither changes status.

Mark as duplicate is for when this incident turns out to be the same event as another. This one is cancelled and points at the one you pick, which stays open as the real incident.

Both match /ff link and /ff duplicate in Slack.

Bring people in

The ⋮ menu carries three ways to involve other people, all of which post in the incident channel.

Ask someone to pick this up names one person and says why you need them. They get a message of their own with an acknowledge button, the ask goes in the incident channel, and Firefight reminds them if they do not answer. Reach for this when you need a particular person to respond, not just to watch.

Bring people in adds responders to the incident channel so they can follow along and join in. It asks nobody for anything, which is the difference from the one above.

Give a shoutout thanks someone for their work, posted in the incident channel where everyone working the incident sees it.

All three match /ff escalate, /ff invite and /ff shoutout in Slack. Each offers the people already in your workspace. To pull in somebody Firefight has not seen yet, invite them from Slack.

While Firefight is still creating the incident’s channel, these three are greyed out with the reason, because all three need a channel to post in. Once the incident is resolved or cancelled, they leave the menu.

Follow an incident without joining it

Not everyone who cares about an incident belongs in its channel. A manager, someone in support, the on-call for a neighbouring service. The Subscribers card on the incident page lists who is following it, and Subscribe adds you. From then on, every update Firefight posts about the incident in the announcement thread in your incidents channel also reaches you as one short direct message from Firefight. That covers updates (with any change to status, severity or type), escalations, and the incident being canceled, resolved or reopened. Actions, follow-ups and channel conversation are not included, since those belong to the people working the incident.

Each message is one short card. It names the incident, says what happened underneath (such as “Resolved by Dana after 1h 12m” or the status that changed and who changed it), shows the words of the update, and ends with Open channel, Open in Firefight and Unsubscribe. A message about one of several incidents you follow is never in doubt, and the full thread is one click away.

Unsubscribe on the card stops the messages, and so does the button at the foot of any message. The Subscribe button on the announcement in your incidents channel subscribes you from Slack. Firefight confirms with a note only you can see, which carries Unsubscribe in case you clicked by mistake.

Ask Halon to investigate

Investigate, beside the channel name at the top right, starts Halon on the incident and opens the run over the page, the same as /ff investigate in the channel. While a run is working on the incident, the button is greyed out, and pointing at it says so and offers Open the run. It shows when Halon’s AI is set up for your workspace and you can start investigations. See Investigations.

Alerts, pages and what changed

Three more panels appear on the incident page when they have something to show.

• Alerts lists the alerts attached to the incident, whether each is still firing, how many times it fired and when it last did. See How alerts work.
• Pages lists each page sent to an on-call tool for the incident and where it stands. See Halon on call.
• What changed lists recent changes to the resources behind the services named on the incident, for anyone who may read the map. See What changed.

Open the channel

The channel name at the top right opens the incident’s channel in your Slack app.

What still lives in Slack

/ff catchup posts a written catch-up into the channel, and has no dashboard equivalent.

See the Slack command reference for everything available there.