Acknowledgment Workflow

The acknowledgment workflow covers how an on-call technician receives a page, responds to it, and brings the incident to resolution.

Incident States

Every incident moves through a defined lifecycle:

State	Description
triggered	Incident created; escalation active; technician has not responded
acknowledged	Technician claimed the incident; escalation paused; investigation in progress
resolved	Incident closed; PSA ticket updated; no further escalation
suppressed	Incident silenced (maintenance window or manual suppression)

How You Receive a Page

When an incident is triggered and escalation reaches your step, you receive a notification via your configured methods:

Email — Sent immediately when your escalation step fires. Subject includes incident title and severity. Body includes incident summary, links to the incident in On-Call, and (for Defend alerts) device name and recommended action.

SMS — Sent to your configured phone number (requires Twilio integration — contact your administrator). Contains incident title, severity, and a short acknowledgment link.

Phone Call — Automated voice call (requires Twilio Voice — contact your administrator). Reads the incident title and severity; press 1 to acknowledge.

Push Notification — Browser or mobile push (requires push permission granted in the On-Call app).

Slack — Message in your configured Slack channel (requires webhook URL in notification preferences).

ℹ️Email is available to all users. SMS, phone, and push require additional integration setup. Contact your administrator if these channels are unavailable.

Acknowledging an Incident

Via the On-Call Dashboard

1. Open the On-Call app at app.theoneoncall.app.
2. The dashboard shows active triggered incidents at the top.
3. Click the incident title to open the detail view.
4. Click Acknowledge.
5. The incident status changes to acknowledged and escalation stops immediately.

Via the Incidents List

1. Click Incidents in the left sidebar.
2. Find the triggered incident (status badge: red "Triggered").
3. Click Acknowledge in the action row, or open the incident and click Acknowledge.

After Acknowledging

When you acknowledge:

• Escalation stops — no further notifications are sent to other steps
• A PSA ticket is auto-created if PSA integration is configured
• The incident timeline records your name and timestamp
• The incident is now assigned to you

Adding Investigation Notes

Document your work as you investigate:

1. Open the incident.
2. Scroll to Notes.
3. Type your note — what you checked, what you found, steps taken.
4. Click Add Note.

Notes are timestamped and attributed to you. They sync to the PSA ticket automatically.

💡Add a note when you start investigating, even if just "Acknowledged, investigating CPU spike on client-server-01." This creates an immediate paper trail and shows the PSA ticket is actively being worked.

Reassigning an Incident

If you need to hand off an incident mid-investigation:

1. Open the incident.
2. Find the Assigned To field.
3. Search for the technician you are handing off to.
4. Click Save.

The incident remains acknowledged — escalation does not restart. The new assignee receives an email notification that the incident was reassigned to them.

Resolving an Incident

When the underlying issue is resolved:

1. Open the incident.
2. Add a final note describing the resolution (optional but recommended).
3. Click Resolve.
4. The incident status changes to resolved.
5. The PSA ticket is updated with resolved status and your resolution summary.
6. The incident is removed from the dashboard's active incidents list.

Auto-Resolution

Services can be configured with an auto_resolve_hours value. If an incident is still in acknowledged or triggered state after that many hours, the auto-resolve timer closes it automatically. This prevents stale incidents from accumulating on the dashboard.

Default: 24 hours. Configure per service in Services → service detail → Auto Resolve.

⚠️Auto-resolution does not mean the underlying problem was fixed — only that the on-call tracking record was closed. Ensure the PSA ticket reflects actual resolution status before the auto-resolve fires.

Snoozing (Temporarily Pausing Escalation)

If you are actively working on an incident but expect to need more time before the next escalation step fires, you can note the status in the incident with a note rather than resolving or letting it escalate. The escalation engine respects the acknowledged status and will not escalate further while you have acknowledged the incident.

Viewing Incident Timeline

Every incident has a full audit timeline:

1. Open the incident.
2. Scroll to Timeline.

The timeline shows every event in chronological order:

• Incident created (alert source, severity, timestamp)
• Each escalation step fired (step number, targets notified, methods used)
• Acknowledgment (who, when)
• Notes added (author, timestamp, content)
• Assignments (from/to)
• Resolution (who, when, summary)

This timeline is preserved indefinitely and is accessible in the reports API for SLA auditing.

Multiple Simultaneous Incidents

During a major outage, you may have multiple triggered incidents at once. The dashboard shows a count of triggered vs acknowledged incidents. To triage:

1. Open Incidents and filter by Status: Triggered.
2. Sort by Severity (critical first).
3. Acknowledge the highest severity incident first.
4. Return to the list for the next.

You can acknowledge multiple incidents before resolving — escalation stops on each as you acknowledge them.