> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/ai-sre-for-administrators/set-up-incident-management/incident-templates.md).

# Configure Incident Types

Learn how to create and manage incident types in Harness AI SRE to standardize incident handling across your organization.

### Overview <a href="#overview" id="overview"></a>

Incident types help you:

* Standardize incident data collection with custom fields
* Create consistent incident creation workflows
* Enable automated runbook execution
* Support compliance requirements
* Speed up incident response

Incident types are configured through the AI SRE UI, not through YAML files. Each incident type defines:

* **Custom fields** - Additional fields specific to this type of incident
* **Creation form layout** - How fields are arranged when creating incidents
* **Pinned runbooks** - Runbooks that are automatically suggested for this incident type
* **Base activity type** - The underlying incident category (e.g., Incident, Alert)

***

### Create an incident type <a href="#create-an-incident-type" id="create-an-incident-type"></a>

To create a new incident type:

1. Navigate to **Project Settings** → **Incident Types** (AI SRE)
2. Click **Create Incident Type**
3. Configure the following:
   * **Name** - Display name for this incident type (e.g., "Service Degradation", "Security Incident")
   * **Short ID** - Unique identifier used in URLs and APIs (e.g., "svc-deg", "sec-inc")
   * **Description** - What this incident type is used for
   * **Base Activity Type** - Select "Incident"
4. Add **Custom Fields**:
   * Click **Add Field**
   * Choose field type: Text, Number, Dropdown, User, Team, Service, etc.
   * Configure field properties:
     * Field name and label
     * Required vs. optional
     * Default value
     * Validation rules
5. Configure **Creation Form Layout**:
   * Drag and drop fields to arrange the incident creation form
   * Group related fields together
   * Set field order for optimal workflow
6. Pin **Recommended Runbooks** (optional):
   * Select runbooks that should be suggested when this incident type is created
   * Pinned runbooks appear at the top of the runbook list during incidents
7. Click **Save**

***

### Common incident type patterns <a href="#common-incident-type-patterns" id="common-incident-type-patterns"></a>

#### Service incident type <a href="#service-incident-type" id="service-incident-type"></a>

**Purpose:** Performance issues, outages, or degradation in a service

**Suggested custom fields:**

* **Service** (Service field, required) - Which service is impacted
* **Environment** (Dropdown: production, staging, development)
* **Impact** (Text area) - Description of user impact
* **Error Rate %** (Number) - Quantify the error rate increase

**Pinned runbooks:**

* Service Health Check
* Scale Service Instances
* Roll Back Deployment

#### Security incident type <a href="#security-incident-type" id="security-incident-type"></a>

**Purpose:** Security alerts, vulnerabilities, or unauthorized access

**Suggested custom fields:**

* **Affected Service** (Service field)
* **Attack Vector** (Dropdown: injection, XSS, credential theft, DDoS, other)
* **Data Exposed** (Yes/No)
* **Compliance Impact** (Dropdown: PCI, SOC2, HIPAA, GDPR, none)

**Pinned runbooks:**

* Security Incident Response
* Isolate Affected Resources
* Notify Security Team

#### Infrastructure incident type <a href="#infrastructure-incident-type" id="infrastructure-incident-type"></a>

**Purpose:** Platform, networking, or infrastructure problems

**Suggested custom fields:**

* **Infrastructure Component** (Dropdown: compute, network, storage, database)
* **Affected Cluster/Region** (Text)
* **Resource Utilization** (Number) - CPU/memory percentage
* **Auto-Scaling Status** (Dropdown: enabled, disabled, failing)

**Pinned runbooks:**

* Check Infrastructure Health
* Scale Infrastructure
* Failover to Secondary Region

***

### Field types and when to use them <a href="#field-types-and-when-to-use-them" id="field-types-and-when-to-use-them"></a>

#### Text field <a href="#text-field" id="text-field"></a>

* Single-line text input
* Use for: titles, short descriptions, identifiers

#### Text area <a href="#text-area" id="text-area"></a>

* Multi-line text input
* Use for: detailed descriptions, impact summaries, notes

#### Dropdown <a href="#dropdown" id="dropdown"></a>

* Single selection from predefined options
* Use for: environment, severity overrides, categorization

#### Number <a href="#number" id="number"></a>

* Numeric input with optional validation
* Use for: percentages, counts, thresholds

#### User <a href="#user" id="user"></a>

* Select a user from the organization
* Use for: incident commander, additional responders

#### Team / user group <a href="#team-user-group" id="team-user-group"></a>

* Select a team responsible for resolution
* Use for: owning team, escalation target

#### Service <a href="#service" id="service"></a>

* Select from your service directory
* Use for: impacted service, related services

#### Date/time <a href="#datetime" id="datetime"></a>

* Calendar and time picker
* Use for: scheduled maintenance windows, deadline tracking

***

### Use incident types <a href="#use-incident-types" id="use-incident-types"></a>

#### Create an incident <a href="#create-an-incident" id="create-an-incident"></a>

When creating an incident:

1. Go to **Incidents** → **Create Incident**
2. Select the **Incident Type** from the dropdown
3. The creation form displays with all fields for that type
4. Fill in required fields (marked with \*)
5. Optionally fill in additional custom fields
6. Click **Create Incident**

#### Quick start (AI-powered) <a href="#quick-start-ai-powered" id="quick-start-ai-powered"></a>

AI SRE can auto-populate incident fields:

1. Click **Quick Start** on the incident creation form
2. Describe the incident in natural language
3. AI extracts relevant details and suggests:
   * Title
   * Severity
   * Service
   * Custom field values
4. Review and adjust the suggestions
5. Click **Create Incident**

#### Select incident type via Slack <a href="#select-incident-type-via-slack" id="select-incident-type-via-slack"></a>

Use the `/harness new` command:

```
/harness new
```

Slack presents a form where you can:

1. Choose the incident type
2. Fill in fields interactively
3. Create the incident without leaving Slack

#### Route alerts auto-create incidents <a href="#route-alerts-auto-create-incidents" id="route-alerts-auto-create-incidents"></a>

Configure route alerts to automatically create incidents of a specific type:

1. Navigate to **Alerts** → **Route Alerts**
2. Create or edit an alert rule
3. Under **Actions**, select **Create Incident**
4. Choose the incident type
5. Map alert fields to incident fields

When alerts match the rule, incidents are auto-created with the specified type.

***

### Manage incident types <a href="#manage-incident-types" id="manage-incident-types"></a>

#### Edit an incident type <a href="#edit-an-incident-type" id="edit-an-incident-type"></a>

To edit an existing incident type:

1. Navigate to **Project Settings** → **Incident Types**
2. Click the incident type to edit
3. Modify fields, layout, or pinned runbooks
4. Click **Save**

**Note**: Changes to incident types affect future incidents. Existing incidents retain their original field structure.

#### Version control <a href="#version-control" id="version-control"></a>

AI SRE tracks incident type versions:

* Each save creates a new version
* Version history is maintained
* Existing incidents reference their original type version
* API integrations use versioned type schemas

#### Delete an incident type <a href="#delete-an-incident-type" id="delete-an-incident-type"></a>

To delete an incident type:

1. Navigate to **Project Settings** → **Incident Types**
2. Click the incident type to delete
3. Click **Delete**
4. Confirm deletion

**Warning**: You cannot delete incident types that:

* Have active incidents
* Are referenced in route alerts
* Are referenced in runbook triggers

***

### Best practices <a href="#best-practices" id="best-practices"></a>

#### Keep types focused <a href="#keep-types-focused" id="keep-types-focused"></a>

* Create distinct incident types for different scenarios
* Avoid creating one "catch-all" type with too many optional fields
* Aim for 5-10 incident types per organization

#### Design for speed <a href="#design-for-speed" id="design-for-speed"></a>

* Put most critical fields first in the creation form
* Make only essential fields required
* Use dropdowns with sensible defaults to reduce typing

#### Enable automation <a href="#enable-automation" id="enable-automation"></a>

* Pin runbooks that are almost always needed for this incident type
* Use consistent field names across types (e.g., always call the service field "Service")
* Create route alerts that map to incident types automatically

#### Review and iterate <a href="#review-and-iterate" id="review-and-iterate"></a>

* Monitor which fields are actually used
* Remove rarely-used custom fields
* Gather feedback from incident responders
* Update types as your processes evolve

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Incident fields reference](/ai-sre/ai-sre-for-administrators/set-up-incident-management/incident-fields.md): Standard fields available on all incidents.
* [Create incidents](/ai-sre/ai-sre-for-incident-responders/create-incidents.md): User guide for creating incidents.
* [Route alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/overview.md): Configure alerts to auto-create incidents.
* [Create a runbook](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/create-runbook.md): Build runbooks to pin to incident types.