Start from the Incident Response project template in Manager. When monitoring opens an incident at 3 a.m., an agent grades it and alerts whoever is on call.
An agent grades each new incident from SEV1 to SEV4, starts the timeline and messages the on-call person.
An incident commander acknowledges and makes the calls. The agent keeps the log and does the legwork.
SEV1 and SEV2 need a postmortem. The agent drafts it from the timeline, and follow-ups get owners.
Incident response treats an outage as a coordinated event, declared early and graded from SEV1, critical, to SEV4, cosmetic. The grade sets who joins, how often stakeholders hear and whether a postmortem follows.
A commander owns it while others investigate, logging everything on a timeline. Stop the impact first; the cause can wait. A blameless postmortem then asks how, not who, and turns lessons into owned action items.
Where each part lives in an Incident Response project.
| Incident response | In Manager |
|---|---|
| Severity levels | The Severity field; severity-rubric sets grades, update cadence and the postmortem rule. |
| Incident commander | The Incident Commander field, a project member who acknowledges via triage. |
| Timeline | The incident's comments, newest last: every observation, action and update. |
| Mitigate first | Mitigated when impact stops, Monitoring while the fix soaks, then Resolved. |
| Postmortem | A linked wiki page; SEV1 and SEV2 carry the Postmortem-Pending label until it is published. |
| Action items | Child Action Items with owner and priority; they may outlive the incident. |
Connect your agent over MCP and create the project from the template.
Say to your agentManager: Create a project from the Incident Response template.
In Settings > Agents, give an agent an action on work_item.created that loads severity-rubric and may comment, edit items and send messages without asking first. Prompt: "If item {number} is an Incident, grade it, open the timeline, message the on-call person."
Alerting creates Incidents via Manager's HTTP API and an API key; if your alerting tool can't send a custom request, a small relay bridges it.
Say to your agentManager: Declare an incident and ask me what is broken and who is affected.
The commander acknowledges, confirms the grade and posts the first update; then SEV1 gets one about every 30 minutes, SEV2 hourly.
Say to your agentManager: Run triage for the new incident with me as the commander.
Findings go on the timeline and leads become Action Items; assign one to an agent and it starts right away.
Say to your agentManager: Ask me how we stopped the impact, log it on the timeline and move the incident to Mitigated.
SEV1 and SEV2 get Postmortem-Pending and a wiki postmortem. Once it is out and Action Items are filed, the incident closes; the items carry on.
Say to your agentManager: The fix has held, so resolve the incident and write the postmortem.
A project created from the Incident Response template starts with these work item types and statuses. You can adapt all of them to your team later.
One incident from detection to close, with its timeline in the comments.
A follow-up or remediation task, filed under its incident.
These skills come with the template in Manager:
severity-rubricDefines SEV1 to SEV4, cadence and the postmortem rule.
declareOpens an incident with severity, commander and impact.
triageCommander acknowledges, grade re-checked, first update sent.
investigateLogs findings on the timeline, files Action Items for leads.
mitigateRecords the mitigation and starts the Monitoring soak.
resolveConfirms the fix held, flags SEV1 and SEV2 Postmortem-Pending.
postmortemWrites the wiki postmortem and files Action Items.
track-actionsChecks Action Item owners, then closes the incident.
Service Management has lighter incidents; use this template when you need a commander and a postmortem. Edit severity-rubric to change grades or cadence.
Changes the agent may not make on its own wait for your approval. New Action Items start the action too; the agent sees they are not Incidents and stops.
Manager notifies in the app and by email. Name the on-call person in the prompt, and keep your paging tool for calls and SMS.
Every incident gets a clean start and a complete timeline, and every SEV1 and SEV2 a postmortem.
Get early access