# Get started with incidents
An incident is a record of a service disruption or performance issue. It serves as the central point for alerting, collaboration, and resolution. When a service fails, an incident is created to track its entire lifecycle, from detection to [post-mortem](https://betterstack.com/docs/uptime/post-mortems/). ## How are incidents created? Incidents can be triggered in several ways: * **Automatically from monitors:** When a [monitor](https://betterstack.com/docs/uptime/uptime-monitor/), [heartbeat](https://betterstack.com/docs/uptime/cron-and-heartbeat-monitor/), or [integration](https://betterstack.com/docs/getting-started/integrations/) detects a problem, an incident is automatically created. This is the most common way incidents are started. * **Manually by users:** Anyone on your team can [report an incident manually](https://betterstack.com/docs/uptime/creating-incidents-manually/) from the dashboard or a secret URL. This is useful for issues that automated monitoring might not catch, like "payment processing is failing." * **Via the API:** You can programmatically [create incidents using our API](https://betterstack.com/docs/uptime/api/create-a-new-incident/), allowing for custom integrations with your internal tools. ## The incident lifecycle Every incident follows a clear path from creation to resolution, ensuring your team is always in sync. ### 1. Started When an incident is created, we immediately notify the right people based on your [on-call schedule](https://betterstack.com/docs/uptime/getting-started-with-oncall/) and [escalation policies](https://betterstack.com/docs/uptime/escalation-policies/). ### 2. Acknowledged A team member takes ownership by [acknowledging the incident](https://betterstack.com/docs/uptime/acknowledging-an-incident/). This action stops further escalations, letting the rest of the team know that someone is working on the issue. ### 3. Resolved Once the underlying problem is fixed, the incident is [marked as resolved](https://betterstack.com/docs/uptime/resolving-an-incident/). This can happen automatically (when a monitor check passes again) or be done manually by a team member. ## Collaborating on incidents The incident detail page is your central hub for collaboration. * **View details:** Access critical information like error messages, response bodies, and screenshots to quickly diagnose the problem. Learn more about [incident details](https://betterstack.com/docs/uptime/incident-details/). * **Leave comments:** Use [comments](https://betterstack.com/docs/uptime/commenting-on-incidents/) to share updates, ask questions, or coordinate with your team. You can use Markdown and attach files. * **Write a post-mortem:** After an incident is resolved, document what happened, what the impact was, and what steps will be taken to prevent it from happening again. Read our guide on [writing post-mortems](https://betterstack.com/docs/uptime/post-mortems/). ## Advanced incident management As your team grows, you can leverage more advanced features to manage incidents more effectively: * [Incident Grouping](https://betterstack.com/docs/uptime/incident-grouping/) - Automatically group related alerts into a single incident to reduce noise and alert fatigue. * [Incident Metadata](https://betterstack.com/docs/uptime/incident-metadata/) - Attach custom data like severity, service, or team ownership to incidents for smarter routing and filtering with [escalation policies](https://betterstack.com/docs/uptime/escalation-policies/). * [Runbooks](https://betterstack.com/docs/uptime/runbooks/) - Create step-by-step guides within your escalation policies to ensure a consistent and efficient response to common incidents.