An incident is a story that unfolds over time. We measure the duration of different chapters in that story to understand how well we responded. These measurements are our key performance indicators (KPIs) for incident management — they tell us where our process is fast, where it's slow, and where to invest in improvement.
The clock starts ticking the moment something actually breaks, not when we notice it. This distinction is critical: a system can be failing for 20 minutes before anyone knows. That silent failure window is part of the incident, and it counts against us.
The Four Key Phases
Every incident passes through these phases in order:
- Detection: The organization becomes aware something is wrong.
- Acknowledge: An engineer takes ownership and begins responding.
- Mitigation: Service is restored to customers (temporary fix).
- Resolution: The root cause is permanently fixed.
Each phase has a corresponding metric. Together, these metrics paint a complete picture of your incident response capability.