Documentation Grafana Cloud Alerts and IRM IRM Manage incidents Customize incident response Incident response settings

Configure incident response settings

Grafana IRM provides configurable settings for incident severity levels, statuses, roles, and custom fields. These settings help standardize your incident management process and ensure consistency across teams.

To access these settings, go to IRM > Settings and select the Incidents tab.

Severity levels

Incident severities in Grafana IRM provide a consistent way to measure the impact of incidents. Customizing these severity levels helps your team understand the urgency of an incident and respond appropriately.

Severity levels can influence your incident response process, such as who is engaged and how quickly you respond. To maximize their effectiveness, define each severity level clearly and ensure your team understands the expected response for each level.

Pre-configured severity levels

Grafana IRM provides the following severity levels by default:

If your organization uses different terminology or prioritization systems, you can customize these severity levels or add new ones to fit your needs.

When you declare a new incident without choosing a severity, it defaults to Pending.

Add incident severity levels

You can add custom severity levels to match your organization’s terminology and priorities.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Severities, click Add new Severity.
4. Provide the following information:
   • Label: A name for the severity level (such as P1, Critical, or High).
   • Level: A numerical value indicating the severity’s priority (e.g., 1 for highest priority).
   • Description: Optionally, provide details about when to use this severity level.
   • Icon: Optionally, select an icon to visually represent the severity.
5. Click Save.

Edit incident severities

You can update existing severity levels to better align with your organization’s processes.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Severities, click the pencil icon next to the severity you want to edit.
4. Modify the Label, Description, Level, or Icon as needed.
5. Click Save.

Example: Mapping custom severities

If your organization uses P1-P4 as severity levels, you might map them as follows:

Archive and unarchive incident severities

Archiving severities allows you to remove those that aren’t relevant without deleting them permanently.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Severities, click the Archive icon next to the severity you want to archive.
4. To unarchive, locate the severity in the archived list and click Unarchive

Delete incident severities

If a severity level is no longer needed, you can delete it.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Severities, click the Trash icon next to the severity you want to delete.
4. Click Confirm remove to permanently delete the severity.

Statuses

Incident statuses in Grafana IRM indicate whether an incident is ongoing or resolved. They help responders and stakeholders quickly understand if incident response is still in progress.

Default incident statuses

Grafana IRM provides the following default statuses:

You can customize these statuses or add new ones to better reflect your organization’s incident process.

Add incident statuses

You can create custom incident statuses to match your organization’s incident lifecycle.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Statuses, click Add new Status.
4. Provide the following information:
   • Name: A name for the status (such as Monitoring, Escalated, or Closed).
   • Description: Optionally, describe the purpose of this status to help your team apply it consistently.
   • Icon: Optionally, select an icon to visually represent the status.
   • Color: Optionally, assign a color to make the status more recognizable.
5. Click Save.

Edit incident statuses

You can customize existing statuses to ensure they match your organization’s workflow.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Statuses, click the pencil icon next to the status you want to edit.
4. Modify the Name, Icon, Color, or Description as needed.
5. Click Save.

Archive and delete incident statuses

You can archive or delete statuses depending on their usage and relevance.

Archive a status

If a status has been used in incidents, archiving prevents future use while preserving historical data.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Statuses, click Archive next to the status you want to archive.

To unarchive a status, locate it in the archived list and click Unarchive.

Delete a status

You can only delete a status that has never been used in incidents.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Statuses, click the trash icon next to the status you want to delete.
4. Click Confirm remove to permanently delete the status.

Reorder incident statuses

You can customize the order in which statuses appear in dropdown menus.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Under Statuses, drag and drop statuses to reorder them as needed.
4. Your changes are saved automatically.

Roles

Incident roles in Grafana IRM help identify who is involved in an incident and what they are responsible for. Assigning roles ensures clarity in communication, decision-making, and task management during incident response.

Pre-configured incident roles

Grafana IRM includes the following recommended key roles by default:

• Commander: Oversees the incident by managing communication, tasks, and necessary updates.
• Investigator: Responsible for diagnosing and resolving the incident.

You can customize these roles or create additional roles to match your organization’s incident response process.

Add a new incident role

You can create custom roles to fit your organization’s specific incident response requirements.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click Add new role.
5. Provide the following information:
   • Name: The name of the role (such as Scribe, Support, or Operations Lead).
   • Description: Optionally, describe the role’s responsibilities to provide clarity for your team.
   • Key Role: Optionally, check this box if this role is critical to your incident response process.
6. Click Add to create the role.

Edit an incident role

You can modify existing roles to ensure they align with your organization’s processes.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the pencil icon next to the role you want to edit.
5. Modify the Name, Description, or Key Role designation as needed.
6. Click Update to save your changes.

Archive an incident role

Archiving a role prevents its use in future incidents but preserves historical data for incidents where the role was previously used.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the lock icon next to the role you want to archive.
5. Click Confirm archive to archive the role.

To restore an archived role, find it in the archived list and click Unarchive.

Delete an incident role

If a role is no longer relevant and has not been used in any incidents, you can delete it permanently.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the trash can icon next to the role you want to delete.
5. Click Confirm remove to permanently delete the role.

Custom fields

Grafana IRM allows you to add custom incident fields to capture organization-specific metadata relevant to your incident management process.

This feature provides the flexibility to customize incidents according to your unique workflows and requirements, ensuring that important details are properly recorded.

Supported data types

You can define custom fields with various input types to capture important incident details and perform incident analysis.

When creating custom fields, you can choose from the following input types:

• Text: A simple text input for freeform data
• Number: A numerical input for quantitative data
• Single-select: A dropdown menu that allows selection of one predefined option
• Multi-select: A dropdown menu that allows selection of multiple predefined options

Add a custom field

To create a custom field:

1. In the Grafana Cloud main menu, click IRM > Settings.
2. Select the Incidents tab.
3. Locate the Custom fields section.
4. Click + Add field.
5. Configure the following settings:
   • Name: Enter a descriptive name for the custom field (for example, Region, or Service Impacted).
   • Description: (Optional) Add a description that explains the purpose of this field to your team.
   • Type: Select the field input type (Text, Number, Single-select, or Multi-select).
   • Mandatory: Toggle this option if the field must be completed before resolving an incident.
6. Click Save.

Edit a custom field

To modify an existing custom field:

1. In the Grafana Cloud main menu, click IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Custom fields section.
4. Click the pencil icon next to the field you want to modify.
5. Update any of the following:
   • Name
   • Description
   • Type
   • Mandatory status
6. Click Save.

Delete a custom field

To delete a custom field:

1. In the Grafana Cloud main menu, click IRM > Settings.
2. Select the Incidents tab.
3. Locate the Custom fields section.
4. Click the trash icon next to the field you want to remove.
5. Click Confirm remove.

Use custom fields during an incident

You can add or update custom field values for both active and resolved incidents:

1. Navigate to the incident page.
2. Locate the Custom Fields section in the right sidebar.
3. Click the section to expand it.
4. Enter values based on the field type:
   • Text fields: Type your text directly
   • Number fields: Enter a numerical value
   • Single-select fields: Choose one option from the dropdown menu
   • Multi-select fields: Select one or more options from the dropdown menu

Best practices

Consider these recommendations when configuring custom fields:

1. Use clear, descriptive field names that align with your organization’s terminology
2. Add helpful descriptions to guide users on how to use each field
3. Use single-select or multi-select fields when possible to maintain consistent data
4. Limit the number of custom fields to prevent information overload during incident response
5. Make fields mandatory only when the information is essential for incident analysis