Incident Milestones

Milestones are used to describe the current status of the incident. They communicate to stakeholders the team's progress in resolving the issue. As responders work their way through incidents on FireHydrant, they will typically transition the Milestone, and FireHydrant automatically logs the timestamps of these changes.

This allows FireHydrant to collect data for holistic incident metrics out-of-the-box like MTT*, Impacted Infrastructure, Responder Impact, and so on.

Milestone timestamps can be adjusted during the incident in Slack (using /fh update) or within the FireHydrant UI, and they can also be adjusted post-incident during the Retrospective phase.

Note: The milestones must be chronologically equal to or greater than the previous. For example, the Acknowledged milestone cannot be earlier than the Started milestone.

Default Milestones

FireHydrant comes with several incident milestones out-of-box. We establish these as basic guidelines for organizations who are either new to incident management or are looking for guidance on best practices.

Started

When the affected system began having problems.

By default, this is set to the time an incident is opened in FireHydrant. We use this timestamp to calculate the time difference to the rest of the milestones.

You can modify this timestamp at any time if the incident actually started prior to opening a FireHydrant incident.

Detected

When a monitoring system (or human) noticed that a system was having problems.

If you open a FireHydrant incident directly from an alert in Slack or automatically from alert routing, this milestone will be set to the timestamp of the alert. When this happens, the Started milestone will also be set to the same timestamp.

If you open an incident without an attached alert, this milestone will remain unpopulated.

Acknowledged

When someone responding to the incident acknowledged the situation.

If you manually kick off a FireHydrant incident, the incident starts in this state and the Started milestone’s time will match it. If the FireHydrant incident was started automatically (e.g. via API or Alert Routing), then you will need to manually transition to this state.

Investigating

When the first concrete step toward triaging and identifying the problem was taken.

You must transition to this milestone manually.

Identified

When the problem was identified and corrective actions began.

You must transition to this milestone manually.

Mitigated

When the system is no longer exhibiting problems to users, but the team is still monitoring the situation.

For example, the team may be waiting to see if signals or SLIs normalize after the corrective action, or maybe the team took temporary corrective measures to stop customer impact, but a more permanent fix is needed before the incident is considered resolved.

You must transition to this milestone manually. If you transition to Resolved state and skip this milestone, it will automatically be filled with the same timestamp as Resolved.

Resolved

When the system is confirmed to be working again with no relapse.

This is also the time when temporary fixes to mitigate the issue are removed, and the system is now behaving as normal.

You must transition to this milestone manually.

Retrospective Started

When the team has begun the retrospective for an incident.

The incident will transition to this milestone when you click "Start Retrospective" in the Command Center or if you run /fh start retro in Slack.

This milestone is tracked and only shown/modifiable in the interface after the incident has Resolved.

Retrospective Completed

When the team has finished reviewing the incident, clarified findings and follow-ups, and published it.

The incident will transition to this milestone when you click "Publish Retrospective" in the Retrospective page.

This milestone is tracked and only shown/modifiable in the interface after the incident has Resolved.