better-stack-incidents

# Better Stack Incidents ## Overview Incidents in Better Stack are triggered automatically when uptime monitors detect downtime, or created manually for ad-hoc issues. Each incident tracks the timeline from detection through acknowledgment to resolution, with associated monitors, status page updates, and on-call notifications. ## Anti-triggers - **A security incident** — Better Stack incidents are uptime events with no threat model, no indicators, and no remediation flow; use `huntress-incidents`. - **The MSP's major-incident process** — if the question is about incident commanders, customer comms, or postmortems rather than a failing check, use `rootly-incidents` or `pagerduty-incidents`. - **Billable follow-up work** — an incident is not a PSA ticket; use `autotask`, `halopsa`, or `connectwise-psa`. - **Telling end users about the outage** — use `betterstack-status-pages`. ## Key Concepts ### Incident Lifecycle 1. **Triggered** - Monitor detects downtime and creates an incident 2. **Acknowledged** - On-call responder acknowledges the incident 3. **Resolved** - The issue is fixed and the incident is closed 4. **Auto-resolved** - Monitor detects recovery and automatically resolves ### Incident Attributes - **Started at** - When the incident was first detected - **Acknowledged at** - When a responder acknowledged - **Resolved at** - When the incident was resolved - **Cause** - The monitor or manual source that triggered it - **Call** - Whether a phone call...