Who can use this feature

Available on monday dev

The Incident Management feature is a ready-made solution that helps you document incidents after they’ve been resolved by capturing all key details, calculating response metrics, and providing dashboards for trend analysis.

It gives you a baseline template and the flexibility to expand with automations and integrations — turning incidents into opportunities to improve reliability.

Where to access Incident Management

To create the Incident management solution, click on the “+” button on the left hand menu. Select Incident Management from the list.

Each Incident management solution will create a new board that includes a main table, a new incident form, and a dashboard that serves as a template that you can customize as you need.

The solution will be added to your left panel for quick access.

Core Capabilities

These are the basic capabilities of the Incident management feature:

• Standardized reporting form – Ensures consistent documentation of incidents.
• Centralized board – Tracks all incidents with auto-calculated KPIs:
• Time-to-detect (TTD)
• Time-to-identify (TTI)
• Time-to-resolve (TTR)
• Dashboards – Visualize downtime by region, severity levels, domains, detection methods, and root causes.
• Context included – Slack channel + RCA doc links keep investigation history connected.

Beyond the Basics

You can go beyond the feature's basic functionality by customizing and expanding your workflow with monday automations and integrations.

Here are some examples of how you can combine the power of automations and integrations with the Incident management feature:

• Automations
• Notify leadership when a Critical incident is logged.
• Auto-create follow-up tasks to ensure RCA completion.
• Trigger reminders for unresolved incidents.
• Extended solutions
• Build a “Report Incident” form that automatically opens a Slack war room and creates a new incident item.
• Connect incident logs with customer status boards to improve communication.
• Combine incident data with product KPIs in cross-team dashboards.

Filling Out the Incident Report Form

In order to make sure each incident report is as useful as possible, there are several fields that need to be filled out. Each field has a specific purpose:

• Incident short description – Clear, concise title (used as incident name).
• Owner – Person responsible for documenting the incident.
• Domain – Business or technical area impacted (e.g., Product, Platform).
• Regions – Geographic regions affected (e.g., US, EU, AU).
• Severity – Level of impact (e.g., High, Critical).
• Start time – When the incident began.
• Detection time – When the problem was first noticed.
• Identify time – When the root issue was identified.
• End time – When the incident was resolved.
• Root cause – The main reason for the incident.
• Effect on the system – Which system areas were impacted.
• Detected by – How the incident was detected (monitoring, customer report, etc.).
• Affected users (%) – Share of users impacted.
• Root cause report link – Link to detailed RCA document.
• Slack channel link – Link to Slack thread/channel used during resolution.

Board & Dashboard

The board tracks each incident submission and calculates TTD, TTI, and TTR.

Dashboards provide insight into incident volume, severity, downtime by region, detection methods, and recurring root causes.