Detect
Severity and priority
Severity describes how serious a single alert or an incident is. Priority is the P1 to P4 ranking an incident carries for the people who respond to it.
Alert severity#
An alert carries one of six severities. Each has its own icon and text label, so severity is never conveyed by colour alone, and severity colour is used for nothing else in the console.
| Severity | Icon |
|---|---|
critical | Octagon with a cross |
major | Warning triangle |
minor | Diamond |
warning | Speech bubble with a warning mark |
indeterminate | Circle with a question mark |
clear | Circle with a check |
The severity of an alert comes from the alarm definition's severity mapping (see Alarm definitions). For provider status conditions, it follows the level the provider itself reports.
Cleared alerts#
A cleared alert keeps the severity it had, shown beside a Cleared label. The record shows what the alert was, not only that it is over.
Predicted alerts#
A predicted-breach alert carries the severity it would have if the limit were crossed, and the Predicted badge. It is not a current failure and is not counted with current failures.
Incident severity#
Incident severity is derived from three inputs:
| Input | Meaning |
|---|---|
| Criticality of impacted systems | The highest criticality among the systems the incident affects |
| Customer-facing journeys | Whether journeys flagged as customer-facing pass through the affected services |
| Signal magnitude | How far the signals involved depart from their expected range |
Severity is re-evaluated whenever a new anomaly, a new alert group or a new cause assessment arrives. Each change is appended to the incident timeline, so the timeline shows when severity rose or fell and which input changed.
In the sample incident INC-20931, payments-gw is an external payment provider on the path of the customer-facing Card checkout journey; the incident is P1 with severity major.
Priority#
An incident carries a priority from P1 to P4. The priority badge has three cues that do not depend on colour: the label text, the fill weight (P1 is solid) and the number of bars.
Health statuses#
Health is separate from severity. A service, system or component has a health status of healthy, degraded, down, unknown or maintenance. Each status has its own shape: a circle for healthy, a diamond for degraded, a square for down, an open circle for unknown and a hatched circle for maintenance. Severity badges and health statuses are different components and are not used for each other's meaning.
What you see in the console#
- Alert lists show the severity badge with its label and the alert count.
- The incident header shows the priority badge and the current severity.
- The timeline shows every severity change.
- In both light and dark themes, the badges keep their icon and label.
Limits and defaults#
- Alert severity is one of the six values above.
- The rules that combine impact criticality, journeys and magnitude into incident severity are configuration, not fixed in the product.
Failure states#
Severity changes are never silent. If a later alert, anomaly or cause assessment raises or lowers incident severity, the change is appended to the timeline with the time it happened (see Incidents).
Related#
Last updated October 2026