> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/3.0/ai-sre-for-administrators/set-up-incident-management/incident-templates.md).

# Configure Incident Types

Learn how to create and manage incident types in Harness AI SRE.

Learn how to create and manage incident types in Harness AI SRE to standardize incident handling across your organization.

### Overview <a href="#overview" id="overview"></a>

Incident types help you:

* Standardize incident data collection with custom fields
* Create consistent incident creation workflows
* Enable automated runbook execution
* Support compliance requirements
* Speed up incident response

Incident types are configured through the AI SRE UI, not through YAML files. Each incident type defines:

* **Custom fields** - Additional fields specific to this type of incident
* **Creation form layout** - How fields are arranged when creating incidents
* **Pinned runbooks** - Runbooks that are automatically suggested for this incident type
* **Base activity type** - The underlying incident category (e.g., Incident, Alert)

***

### Create an incident type <a href="#create-an-incident-type" id="create-an-incident-type"></a>

To create a new incident type:

1. Navigate to **Project Settings** → **Incident Types** (AI SRE)
2. Click **Create Incident Type**
3. Configure the following:
   * **Name** - Display name for this incident type (e.g., "Service Degradation", "Security Incident")
   * **Short ID** - Unique identifier used in URLs and APIs (e.g., "svc-deg", "sec-inc")
   * **Description** - What this incident type is used for
   * **Base Activity Type** - Select "Incident"
4. Add **Custom Fields**:
   * Click **Add Field**
   * Choose field type: Text, Number, Dropdown, User, Team, Service, etc.
   * Configure field properties:
     * Field name and label
     * Required vs. optional
     * Default value
     * Validation rules
5. Configure **Creation Form Layout**:
   * Drag and drop fields to arrange the incident creation form
   * Group related fields together
   * Set field order for optimal workflow
6. Pin **Recommended Runbooks** (optional):
   * Select runbooks that should be suggested when this incident type is created
   * Pinned runbooks appear at the top of the runbook list during incidents
7. Click **Save**

***

### Common incident type patterns <a href="#common-incident-type-patterns" id="common-incident-type-patterns"></a>

#### Service incident type <a href="#service-incident-type" id="service-incident-type"></a>

**Purpose:** Performance issues, outages, or degradation in a service

**Suggested custom fields:**

* **Service** (Service field, required) - Which service is impacted
* **Environment** (Dropdown: production, staging, development)
* **Impact** (Text area) - Description of user impact
* **Error Rate %** (Number) - Quantify the error rate increase

**Pinned runbooks:**

* Service Health Check
* Scale Service Instances
* Roll Back Deployment

#### Security incident type <a href="#security-incident-type" id="security-incident-type"></a>

**Purpose:** Security alerts, vulnerabilities, or unauthorized access

**Suggested custom fields:**

* **Affected Service** (Service field)
* **Attack Vector** (Dropdown: injection, XSS, credential theft, DDoS, other)
* **Data Exposed** (Yes/No)
* **Compliance Impact** (Dropdown: PCI, SOC2, HIPAA, GDPR, none)

**Pinned runbooks:**

* Security Incident Response
* Isolate Affected Resources
* Notify Security Team

#### Infrastructure incident type <a href="#infrastructure-incident-type" id="infrastructure-incident-type"></a>

**Purpose:** Platform, networking, or infrastructure problems

**Suggested custom fields:**

* **Infrastructure Component** (Dropdown: compute, network, storage, database)
* **Affected Cluster/Region** (Text)
* **Resource Utilization** (Number) - CPU/memory percentage
* **Auto-Scaling Status** (Dropdown: enabled, disabled, failing)

**Pinned runbooks:**

* Check Infrastructure Health
* Scale Infrastructure
* Failover to Secondary Region

***

### Field types and when to use them <a href="#field-types-and-when-to-use-them" id="field-types-and-when-to-use-them"></a>

#### Text field <a href="#text-field" id="text-field"></a>

* Single-line text input
* Use for: titles, short descriptions, identifiers

#### Text area <a href="#text-area" id="text-area"></a>

* Multi-line text input
* Use for: detailed descriptions, impact summaries, notes

#### Dropdown <a href="#dropdown" id="dropdown"></a>

* Single selection from predefined options
* Use for: environment, severity overrides, categorization

#### Number <a href="#number" id="number"></a>

* Numeric input with optional validation
* Use for: percentages, counts, thresholds

#### User <a href="#user" id="user"></a>

* Select a user from the organization
* Use for: incident commander, additional responders

#### Team / user group <a href="#team-user-group" id="team-user-group"></a>

* Select a team responsible for resolution
* Use for: owning team, escalation target

#### Service <a href="#service" id="service"></a>

* Select from your service directory
* Use for: impacted service, related services

#### Date/time <a href="#datetime" id="datetime"></a>

* Calendar and time picker
* Use for: scheduled maintenance windows, deadline tracking

***

### Use incident types <a href="#use-incident-types" id="use-incident-types"></a>

#### Create an incident <a href="#create-an-incident" id="create-an-incident"></a>

When creating an incident:

1. Go to **Incidents** → **Create Incident**
2. Select the **Incident Type** from the dropdown
3. The creation form displays with all fields for that type
4. Fill in required fields (marked with \*)
5. Optionally fill in additional custom fields
6. Click **Create Incident**

#### Quick start (AI-powered) <a href="#quick-start-ai-powered" id="quick-start-ai-powered"></a>

AI SRE can auto-populate incident fields:

1. Click **Quick Start** on the incident creation form
2. Describe the incident in natural language
3. AI extracts relevant details and suggests:
   * Title
   * Severity
   * Service
   * Custom field values
4. Review and adjust the suggestions
5. Click **Create Incident**

#### Select incident type via Slack <a href="#select-incident-type-via-slack" id="select-incident-type-via-slack"></a>

Use the `/harness new` command:

```
/harness new
```

Slack presents a form where you can:

1. Choose the incident type
2. Fill in fields interactively
3. Create the incident without leaving Slack

#### Route alerts auto-create incidents <a href="#route-alerts-auto-create-incidents" id="route-alerts-auto-create-incidents"></a>

Configure route alerts to automatically create incidents of a specific type:

1. Navigate to **Alerts** → **Route Alerts**
2. Create or edit an alert rule
3. Under **Actions**, select **Create Incident**
4. Choose the incident type
5. Map alert fields to incident fields

When alerts match the rule, incidents are auto-created with the specified type.

***

### Manage incident types <a href="#manage-incident-types" id="manage-incident-types"></a>

#### Edit an incident type <a href="#edit-an-incident-type" id="edit-an-incident-type"></a>

To edit an existing incident type:

1. Navigate to **Project Settings** → **Incident Types**
2. Click the incident type to edit
3. Modify fields, layout, or pinned runbooks
4. Click **Save**

**Note**: Changes to incident types affect future incidents. Existing incidents retain their original field structure.

#### Version control <a href="#version-control" id="version-control"></a>

AI SRE tracks incident type versions:

* Each save creates a new version
* Version history is maintained
* Existing incidents reference their original type version
* API integrations use versioned type schemas

#### Delete an incident type <a href="#delete-an-incident-type" id="delete-an-incident-type"></a>

To delete an incident type:

1. Navigate to **Project Settings** → **Incident Types**
2. Click the incident type to delete
3. Click **Delete**
4. Confirm deletion

**Warning**: You cannot delete incident types that:

* Have active incidents
* Are referenced in route alerts
* Are referenced in runbook triggers

***

### Best practices <a href="#best-practices" id="best-practices"></a>

#### Keep types focused <a href="#keep-types-focused" id="keep-types-focused"></a>

* Create distinct incident types for different scenarios
* Avoid creating one "catch-all" type with too many optional fields
* Aim for 5-10 incident types per organization

#### Design for speed <a href="#design-for-speed" id="design-for-speed"></a>

* Put most critical fields first in the creation form
* Make only essential fields required
* Use dropdowns with sensible defaults to reduce typing

#### Enable automation <a href="#enable-automation" id="enable-automation"></a>

* Pin runbooks that are almost always needed for this incident type
* Use consistent field names across types (e.g., always call the service field "Service")
* Create route alerts that map to incident types automatically

#### Review and iterate <a href="#review-and-iterate" id="review-and-iterate"></a>

* Monitor which fields are actually used
* Remove rarely-used custom fields
* Gather feedback from incident responders
* Update types as your processes evolve

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Incident fields reference](/ai-sre/3.0/ai-sre-for-administrators/set-up-incident-management/incident-fields.md): Standard fields available on all incidents.
* [Create incidents](/ai-sre/3.0/ai-sre-for-incident-responders/create-incidents.md): User guide for creating incidents.
* [Route alerts](/ai-sre/3.0/ai-sre-for-administrators/set-up-alert-management/alert-rules/overview.md): Configure alerts to auto-create incidents.
* [Create a runbook](/ai-sre/3.0/ai-sre-for-administrators/set-up-runbook-management/create-runbook.md): Build runbooks to pin to incident types.

{% @harness-feedback/feedback %}