Incident Core Types: incident.io (Private Beta)

Incident core types provides a unified, reliable way to ingest, view, and analyze data from incident providers, starting with incident.io Get a single source of truth for all your incidents with full support in CQL, Scorecards, and Engineering Intelligence.

Incident core types is currently only availible for incident.io customers. We will be migrating all incident providers to the new system over the coming months!

What's new

The Incident core type introduces a centralized approach to incident data in Cortex:

• Unified incident catalog: View all incidents across your organization in one place, with rich metadata including severity, status, affected entities, and more.

• Entity-level incident visibility: See active incidents directly on entity pages and quickly identify which services are currently impacted

• Full CQL support: Write rules and queries using incident data with the new incidents and oncall CQL expressions.

• Multiple data sources: Ingest incidents from incident.io via our integration platform, or push custom incident data via API,

• Engineering Intelligence integration: Access incident metrics you rely on today, now powered by a single, consistent data pipeline.

Viewing incidents

Incident Catalog

Access the Incident Catalog from the main navigation by going to All entities --> Entity types --> Incident to see all incidents across your organization.

The Incident Catalog displays the following information with the default view sorted by most recently opened incidents first.

Column	Description
Incident name	The title of the incident
Severity	The severity level assigned to the incident
Status	Current status (e.g., Active, Resolved)
Opened at	When the incident was created

Incident detail page

Click on any incident in the catalog to view its full details, including:

• Complete incident metadata

• All affected entities

• Link to the source system

• Entity YAML

• Entity relationships

Incidents on entity pages

Entity pages include incident information in two places:

• Overview tab: Active incidents are prominently displayed at the top of the page

• Incidents tab: View a complete list of incidents for that entity

Using incident data

CQL expressions

The new incidents CQL categories let you write powerful queries and Scorecard rules based on incident data.

See the CQL documentation for the complete list of available incident expressions.

Scorecards

Create Scorecard rules using incident-based CQL expressions to track operational health:

• Ensure services have had no critical incidents in the past 30 days

• Verify mean time to resolution meets your SLOs

• Check that all production services have on-call schedules configured

Engineering Intelligence

Incident metrics available in Engineering Intelligence are now powered by the same unified data pipeline, ensuring consistency across all Cortex features. The following metrics are supported:

• Incident frequency

• Mean time to resolution (MTTR)

Upcoming enhancements

We plan to develop additional capabilities during and beyond the beta period:

• Support for on-call as a core type

• Support for incident.io follow up items

• Additional incident provider integrations (PagerDuty, Rootly, and more)

• Enhanced incident analytics