Incident response

Escalation that runs until someone acknowledges

Use WardenPoint as the alerting tier of your incident-response process. Acknowledgement closes the chain; resolved hooks cancel it; the audit log feeds your post-mortem. Quiet hours and snooze respect responder time without blocking P1 — critical priority always bypasses.

Start free Talk to incident lead
Acknowledgement-aware Multi-channel chain Audit-ready timeline

Incident timeline

  1. 00:00
    Source
    Sentry critical error · ChargeFailedException spike
  2. 00:02
    WardenPoint
    Telegram + voice to incident commander on-call
  3. 00:07
    Commander
    Acks · opens war-room · pages payments team
  4. 00:18
    Source
    Resolved hook · WardenPoint cancels chain · audit closes

Where IR teams hurt

Incident response pain — and what we change

Three complaints from incident-response leaders about their existing alerting layer.

Alert fatigue blunts the signal

Critical pages overlap with noisy warnings. Responders stop trusting the page; SLA suffers.

Fix

Only severity=critical fires voice. Severity is a contract, not a hint.

No structured timeline

Post-mortem authors stitch together Slack scrollbacks, PagerDuty exports and email threads.

Fix

One audit log per incident UUID. Every dispatch, ack and resolve is one line away.

Hand-off gaps

When the on-call hands the incident to a specialist, alerts keep paging the wrong person.

Fix

Manual ack stops the chain; re-dispatch fires to the new responder. No lingering retries.

Escalation policy

Recipe: incident-commander escalation

Suited to teams with an Incident Commander role. The chain starts loud and gets louder, but stops the moment someone takes ownership.

  1. 1
    At minute
    0:00

    Primary IC by voice + Telegram

    Whichever IC is on-rotation gets a phone call and a Telegram message simultaneously.

    voice_calltelegram_voice
  2. 2
    At minute
    0:03

    Backup IC by voice

    If unacknowledged, the secondary IC is paged. Email lands on the war-room channel.

    voice_callemail
  3. 3
    At minute
    0:08

    Wake the manager

    Engineering manager gets a phone call. By this minute the situation has obvious staffing implications.

    voice_call
  4. 4
    At minute
    0:15

    Page the on-call director

    Last resort. Triggered rarely; tested quarterly via the 'Send test' button.

    voice_calltelegram_voicesms

Sources of incidents

Where incidents come from

Incident-response teams need to accept signals from everywhere — monitoring, error tracking, uptime, business metrics.

Grafana
Metrics + logs
Sentry
Application errors
Prometheus
Alertmanager
Uptime Kuma
Endpoint uptime
Webhooks
Custom anomaly

What changes

What IR teams report

Faster acknowledgement

Phone-first delivery to a small set of named responders shortens the time between alert and ack.

Auditable timeline

Post-mortems include the structured audit log directly. No 'who was paged when' archaeology.

Chain stops cleanly

Acknowledgement is canonical. No two responders thinking they are still on the hook.

IR FAQ

Incident-response questions

Each incident has its own UUID and its own escalation chain. Acknowledging one does not affect the others. Recipients see distinct alerts.
Free plan

Try the chain that stops when someone owns the incident

Wire a sample policy, fire a test from curl and watch the audit timeline render in real time.

Start free Talk to incident lead
  • Acknowledgement cancels chain
  • Auditable timeline
  • Clean handoffs