Documentation Grafana Cloud Alerts and IRM IRM Configure Incident settings Incident roles

Define incident roles

Incident roles in Grafana IRM help identify who is involved in an incident and what they are responsible for. Assigning roles ensures clarity in communication, decision-making, and task management during incident response.

Pre-configured incident roles

Grafana IRM includes the following recommended key roles by default:

• Commander: Oversees the incident by managing communication, tasks, and necessary updates.
• Investigator: Responsible for diagnosing and resolving the incident.

You can customize these roles or create additional roles to match your organization’s incident response process.

Add a new incident role

You can create custom roles to fit your organization’s specific incident response requirements.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click Add new role.
5. Provide the following information:
   • Name: The name of the role (such as Scribe, Support, or Operations Lead).
   • Description: Optionally, describe the role’s responsibilities to provide clarity for your team.
   • Key Role: Optionally, check this box if this role is critical to your incident response process.
6. Click Add to create the role.

Edit an incident role

You can modify existing roles to ensure they align with your organization’s processes.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the pencil icon next to the role you want to edit.
5. Modify the Name, Description, or Key Role designation as needed.
6. Click Update to save your changes.

Archive an incident role

Archiving a role prevents its use in future incidents but preserves historical data for incidents where the role was previously used.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the lock icon next to the role you want to archive.
5. Click Confirm archive to archive the role.

To restore an archived role, find it in the archived list and click Unarchive.

Delete an incident role

If a role is no longer relevant and has not been used in any incidents, you can delete it permanently.

1. In the Grafana Cloud main menu, go to IRM > Settings.
2. Select the Incidents tab.
3. Scroll to the Roles section.
4. Click the trash can icon next to the role you want to delete.
5. Click Confirm remove to permanently delete the role.