All chapters
Incidents
An incident is Huntress's unit of attention. It groups the events that belong together into one record with a severity, a confidence and a full timeline, so an operator handles a situation, not a stream of readings.
How incidents are created#
Incidents come from rules: the Create incident action opens one, or adds the event to the incident that is already ongoing for the same source and domain. An incident is for a sensor, a person or, depending on the rule's grouping, a whole place. There is no manual “create incident” button.
Lifecycle#
An incident is Ongoing until it is Resolved. It can be resolved by an operator, by a rule (Resolve incident), automatically when the source restores, after a period without new events, or when a schedule ends. The incident records which, and the timeline says so.
- Resolve one incident, with a confirmation, from its page or a list.
- Resolve many at once with Resolve selected in any incident table (All Incidents, a place or a person). Only ongoing incidents can be selected, and R resolves the focused row from the keyboard.
- The top bar and the Dashboard show how many are ongoing and update live.
- Resolved incidents are kept for
Retention:ResolvedIncidentDays(365 days by default).
Severity#
Severity runs from Info and Low through Medium and High to Critical, or Unclassified. It comes from the rule's action or from the event, and a rule can escalate it.
Confidence#
Every incident carries a confidence level that reflects how sure Huntress is that something real is happening. It rises as corroboration arrives and never falls on its own.
| Level | Name | How it is reached |
|---|---|---|
| C1 | Unconfirmed | A single report. Where every incident starts. |
| C2 | Suspected | Two distinct sources report within the same incident. |
| C3 | Probable | Three or more distinct sources, across sensors or protocols (for example motion and a door contact in the same place). |
| C4 | Confirmed | Set by a rule: the initial confidence of Create incident, or the Escalate incident action. Use it for evidence you trust more than corroborating sensors. |
| C5 | Verified | A verified alarm code from a panel (SIA BV, BG, BM, FM, FV, HV; Contact ID 139), or a rule that sets it. |
Timeline and notes#
An incident's page has a Summary and a Timeline. The timeline merges, in time order, the incident's creation, every event added to it, operator notes and the resolution.
- Notes are free text from any member, including Viewers. A note can be attached to a specific event and others can reply to it, forming a thread.
- A system resolution note records who or what resolved the incident and when.
- The external reference is a free-text field for a ticket or case number (such as
JIRA-1234). Huntress does not integrate with ticket systems; the reference is how you link back.
Who can do what#
Owners, Admins and Viewers can all triage: resolve incidents, write notes and set the external reference. Only Owners and Admins change the rules that open incidents.
Not included#
Incidents have no owner or assignment, no SLA timers and no export. Use a webhook from the rule to hand them to a ticketing or paging system.