Incident streams

Break large incidents into focused streams, each with its own lead, participants, and updates.

Major incidents can pull in dozens of responders, with even more people following along. As things unfold, different groups often end up working on separate tracks: engineering on mitigations, customer success keeping customers updated, legal on compliance. Run it all from a single incident and those parallel efforts start to crowd each other out, with updates and actions from one group burying another’s.

Streams give each of those workstreams its own space, with its own lead, participants, updates, and actions, so every group stays focused without losing sight of the wider incident. Stream activity still surfaces in the main incident timeline, labeled with the stream it came from, so you keep one clear record of everything that happened.

Streams are available on the Enterprise plan.

Slack

Creating a stream

To create a stream, type /incident stream in an incident channel.

You’ll be presented with a modal to:

• Set a name for the stream
• Assign a stream lead. This is usually a different person to the main incident lead, to avoid splitting their focus.
• Invite anyone else who should collaborate on the stream

You can also create streams from the incident dashboard, or automatically via workflows, including specifying initial participants when the stream is created.

We’ll create a new Slack channel for the stream, and invite the stream lead and any participants.

If you’ve configured automatic call links we’ll also create one for your stream. If not, you can manually link a video call from the stream channel, just like in an incident channel.

Managing a stream

Posting updates

To share an update, type /incident update in a stream channel, just like you would in an incident channel.

You’ll be presented with a modal that:

• Lets you provide a short message to update people on what’s going on
• Lets you set a reminder for your next update, so you don’t have to remember manually. We’ll come back and remind you when an update is due.

Alternatively, you can share an update from the stream in the dashboard.

Any update you share is posted in the stream channel, and also announced in the incident channel for anyone following along there.

Creating actions

Track the work happening in a stream by creating actions, just like you would in an incident. Actions are the things that need doing now to move the stream forward, like rebooting a server, drafting customer comms, or pulling a list of affected accounts.

You can create and manage actions from the stream channel, or from the stream’s dashboard page:

• In Slack, run /incident action in the stream channel. With no message we’ll show the open actions for that stream. Add a description (for example /incident action draft customer comms) to jump straight to creating one. You can also react to any message with :boom: to turn it into an action.
• In the dashboard, open the stream and use the Actions section on the Overview tab. Select the + button to add an action, then assign it, mark it complete, edit, or delete it.

Actions you create in a stream stay scoped to that stream, so each stream keeps its own focused list of work without cluttering the main incident. For public streams, action activity also flows into the parent incident timeline, labeled with the stream it came from.

Actions in a stream don’t convert into follow-ups. Streams don’t have their own post-incident flow. Once a stream is closed you can still update or tidy up its existing actions, but you won’t be able to create new ones.

Assigning roles

Just like incidents, nominate a person to lead each stream. We recommend a separate lead for each stream, as they cover different areas of work in different Slack channels.

If you’ve set up custom incident roles, we’ll make those available in streams too. Any role available in the parent incident is available in its streams.

From within the stream channel, use commands such as /inc lead and /inc handover to reassign roles, just as you would in an incident.

Restricting access to streams

You can restrict access to a stream by making it private, so sensitive work stays visible only to the people who need it. Read more about private streams here.

Shortcuts and emoji

If you’ve learnt just one command you can use it in streams too. Type /inc in a stream’s Slack channel to pop up a menu of every action you can run in a stream.

You can also react to messages in a stream channel with:

Emoji	Action
:pushpin: :bookmark: :thought_balloon: :round_pushpin: :star: :star2:	Pins the message from the stream to the incident’s timeline
:mega: :speech_balloon:	Turns the message into an update
:boom:	Turns the message into an action

The full set of stream commands:

Command	Description
ROLES
/incident lead	Make someone the stream lead. /incident lead [me | @user] to auto-fill the lead
/incident roles /incident role	View, assign and unassign roles in the stream
/inc handover	Hand over responsibilities in a stream to another user
WORK
/incident action /incident actions	Create and manage actions for the stream
COMMUNICATION
/incident update	Provide an internal status update to your team about the stream
/incident close	Provide a closing update, and mark the stream as closed
/incident request /incident request-update	Request an internal status update from the stream lead
/incident escalate /incident page	Pull in other teammates for help
/incident call	Set a call link. /incident call [link] to auto-fill the link
/incident statuspage	Post or update an incident on your status page

Closing a stream

Once a stream of work is complete, type /incident close in the stream channel.

You’ll be presented with a modal that asks you to provide a final update on the stream.

The stream is marked as closed, and the final update is posted in the incident channel to keep everyone up to speed.

You can also close a stream from the dashboard, the same way you provide an update.

Microsoft Teams

Creating a stream

Head to the incident’s page and select Create a stream. You can get there from your browser, or from the incident.io tab in the incident’s channel in Teams.

In the drawer that opens, set:

• A name for the stream
• A stream lead. This is usually a different person to the main incident lead, to avoid splitting their focus.

You can also create streams automatically via workflows, including specifying initial participants when the stream is created.

When the stream is created, we post a message in your incident channel with a link to the stream’s page in the dashboard, where all its work happens.

Managing a stream

Posting updates

Share an update from the stream’s page in the dashboard. We’ll post it as a message in your incident channel, so anyone following along stays up to speed.

Creating actions

Track the work happening in a stream by creating actions, just like you would in an incident. Actions are the things that need doing now to move the stream forward, like rebooting a server, drafting customer comms, or pulling a list of affected accounts.

Create and manage actions from the stream’s page in the dashboard, using the Actions section on the Overview tab. Select the + button to add an action, then assign it, mark it complete, edit, or delete it.

Actions you create in a stream stay scoped to that stream, so each stream keeps its own focused list of work without cluttering the main incident. Action activity also flows into the parent incident timeline, labeled with the stream it came from.

Actions in a stream don’t convert into follow-ups. Streams don’t have their own post-incident flow. Once a stream is closed you can still update or tidy up its existing actions, but you won’t be able to create new ones.

Assigning roles

Just like incidents, nominate a person to lead each stream. We recommend a separate lead for each stream, as they cover different areas of work.

Assign the stream lead when you create the stream, and change it later from the stream’s page in the dashboard. If you’ve set up custom incident roles, those are available in streams too. Any role available in the parent incident is available in its streams.

Closing a stream

Once a stream of work is complete, close it from its page in the dashboard and provide a final update. The stream is marked as closed, and the final update is posted in your incident channel to keep everyone up to speed.

FAQs

Do streams have their own roles and leads?

Yes. Each stream has its own stream lead, and any custom incident roles you’ve configured are available in streams. We recommend assigning a different lead for each stream and the parent incident, to avoid splitting focus.

Do actions in a stream become follow-ups?

No. Streams don’t have their own post-incident flow, so actions in a stream don’t convert into follow-ups. Once a stream is closed you can still update its existing actions, but you won’t be able to create new ones.

Can I create a video call for a stream?

Yes, on both Slack and Microsoft Teams. If you’ve configured automatic call links, we create one automatically when the stream is created. You can also add or change the call link yourself from the stream’s page in the dashboard. In Slack, you can additionally set it with /incident call from the stream channel.