Skip to main content

Major incident management

R
Written by Riya Sebastian
Updated over 3 weeks ago

A major incident is an unplanned event, such as a network outage, a printer malfunction, or an app failure, that causes significant disruption to business operations, often affecting a large number of users or critical systems. Triaging and resolving these incidents requires early diagnosis and coordinated efforts.

To identify these incidents faster, Atomicwork will:

  • Notify admins when multiple incidents with the same intent are received within a specific timeframe

  • Enable one-click acknowledgement of major incidents and automatically link incidents under a primary incident

  • Intelligently link new incidents with the same intent to the primary incident and notify users with an auto-responder

  • Broadcast updates to all linked incidents at the same time

  • Enable agents to update attributes for all linked incidents simultaneously

Diagnosing major incidents

Major incidents are detected using enhanced logic that supports configurable thresholds for sensitivity, volume, and time window. Workspaces can fine-tune incident grouping with sensitivity modes: Strict for precise matching, Neutral (default) for balanced grouping, and Broad for maximum coverage.

  • To choose where the notification is received, navigate to Settings > Your IT Workspace > General.

  • Click on the Requests tab to see all the request settings. Click on Configure.

  • Choose the sensitivity mode you prefer: strict (Only groups incidents that are nearly identical. Best for reducing noise), neutral (Groups incidents with the same root problem, even if worded differently), broad (Groups incidents with loose or partial similarities. Shows more matches).

  • Choose the Alert settings.

    • The number of incidents that trigger a major incident. The minimum is 5 and the max is 100

    • The time interval for an incident escalation. The minimum is 5 minutes and the maximum is 60 minutes.

  • You can choose to alert workspace admins in one of two ways:

    • Send a DM to each workspace admin

    • Post a message to a public channel in Teams/Slack

  • On acknowledgement by any admin, the related incidents are linked under a primary incident.

NOTE: If you do not wish to automatically cluster related incidents in this manner, you can toggle the Group similar incidents setting off.

Working on a major incident

  • Navigate to Your IT Workspace > Requests. In the workspace views, you can see the primary incident and the number of incidents linked to it.

  • On clicking through to the primary incident, you can see a list of all the linked incidents. You can choose to manually unlink any incident that you may feel has been incorrectly linked.

  • Click on Manage to configure how new related incidents are handled.

  • Toggle the Link new incidents option to automatically link incoming related incidents to this primary incident for 24 hours.

  • You can send a predefined message as an automatic first response to any new incident that is detected and linked to this primary incident.

Communicating updates

You can send incident updates to all the requesters simultaneously by broadcasting messages to all linked incidents. Toggle the Broadcast message option on to do so when responding on the primary incident.

Managing attributes

You can modify certain incident attributes for all linked incidents simultaneously.

  • Select any linked request from the list of linked incidents. To modify all requests at once, click on Select All in the bottom modal.

  • You can change the status, assignee, category and/or subcategory of linked requests.

Did this answer your question?