Skip to Content
User GuideWar Room & Major Incidents

War Room & Major Incidents

When an incident is severe enough to require coordinated response (e.g., P1/P2, customer-impacting), you can declare a major incident and use the War Room to coordinate status, action items, and stakeholders.

Where to find War Room and major incidents

  1. Incidents — From an open incident, use Declare major incident to create a major incident and open the war room.
  2. ITSM (or Major Incidents) — View all major incidents and their status (e.g., Declared, War room active, Investigating, Mitigating, Resolved).
  3. War Room (left sidebar or under Incidents/ITSM) — Dedicated view for the active major incident: status updates, action items, channel link, conference bridge.

Major incidents list — Title, Status, Severity, War room

Capture from: Tenant Plane → RESPOND → Incidents (or War room). Add as public/img/major-incidents-list.png.

Declaring a major incident

  1. Open the Incident that represents the major event.
  2. Click Declare major incident (or Escalate to MIM / Open war room).
  3. Fill in:
    • Title — Usually pre-filled from the incident.
    • Summary — Short description of impact and scope.
    • Business impact — e.g., “Payment API down; checkout affected.”
    • Affected services — List or select services (from CMDB/topology if integrated).
    • Stakeholders — Who should be notified (optional; depends on configuration).
  4. Submit. The incident is now linked to a major incident record; status is typically Declared or War room active.

Declare major incident — Title, Summary, Business impact, Affected services

Capture from: Tenant Plane → Incidents → Declare major incident. Add as public/img/declare-major-incident.png.

Using the War Room

  1. Open War Room (or select the major incident from ITSM / Incidents).
  2. You’ll see:
    • Status — Current MIM status (e.g., War room active, Investigating, Mitigating, Resolved).
    • Status updates — Timeline of short updates (e.g., “RCA in progress,” “Fix deployed, monitoring”).
    • Action items — Tasks assigned to responders (e.g., “Restart service X,” “Notify customers”).
    • War room links — Channel URL (e.g., Slack/Teams), conference bridge link if configured.
  3. Post a status update: Add a short message and optionally check “Notify stakeholders” so they receive the update.
  4. Add/complete action items: Create an action item, assign it, and mark it done when finished.
  5. Change status: Move to Investigating, Mitigating, or Resolved as the situation evolves.

War room view — Status, updates, action items, Channel/Conference

Capture from: Tenant Plane → Incident → War room. Add as public/img/war-room-view.png.

When creating or editing the major incident, you can set:

  • Channel URL — Link to Slack, Teams, or similar (e.g., for real-time chat).
  • Conference bridge — Link to Zoom, Meet, or phone bridge for voice/video.

These appear in the War Room so responders and stakeholders can join with one click.

Resolving and closing

  1. When the issue is fixed and verified, set status to Resolved.
  2. Optionally add a final Status update (e.g., “Root cause was X; fix deployed. Monitoring for 24h.”).
  3. Use Create post-mortem from the incident (or MIM) to generate a structured post-incident review. See Incidents for PIR templates.

Example flow

  1. Alert fires → Incident created automatically or manually.
  2. On-call declares major incident from the incident; fills summary and affected services.
  3. Team joins via War room link (channel + conference).
  4. Status updates: “RCA started,” “Database failover in progress,” “Failover complete; verifying.”
  5. Action items: “Restart replica,” “Notify #customers” — marked done as completed.
  6. Status set to Resolved; post-mortem created for the incident.

Next steps

Scheduling & AutomationMonitoring Policies