> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incidents

> Track, investigate, and resolve security incidents with a full audit trail.

The Incidents page tracks security incidents across your environment — from detection through resolution. Incidents can be created automatically from connected integrations or logged manually.

## How incidents are created

Incidents flow into DSALTA from two sources:

* **Integration-sourced** — Six integrations write to this page: **Datadog**, **Grafana**, **ServiceNow**, **Sentry**, **Freshdesk** and **Honeybadger**. Each record shows the integration name as its source.
* **Manual** — Your team can log incidents directly in DSALTA. Manual incidents show Source: Manual.

Both types appear in the same table and are treated identically during audits.

<Note>
  Security findings from your cloud providers and code scanners — AWS, Azure, GCP, GitHub, GitLab — are tracked on [Vulnerabilities](/guides/data-library/vulnerabilities).

  To manage one of those findings as an incident as well, log it with **Create Incident** and reference the finding ID in the description.
</Note>

## Incident details

Each incident displays:

| Column       | Description                                              |
| ------------ | -------------------------------------------------------- |
| **ID**       | The incident record's identifier                         |
| **Title**    | Name or summary of the incident                          |
| **Source**   | Integration name, or Manual                              |
| **Status**   | Open, Investigating, Contained, Resolved, or Closed      |
| **Severity** | Critical, High, Medium, or Low                           |
| **Owner**    | Team member responsible for investigation and resolution |
| **Reported** | When the incident was first detected or reported         |

Type is captured on the incident itself but is not a column in this table.

Click any incident to view the full detail page with:

* **Timeline** — Chronological log of all actions taken, status changes, and notes
* **Root cause** — What caused the incident
* **Remediation** — Steps taken to resolve and prevent recurrence
* **Lessons learned** — What your team would do differently next time
* **Breach** — The data-breach categories recorded on the incident (PII, PHI, Financial, Credentials), shown as badges in the detail header
* **Attachments** — Supporting documents, screenshots, or reports

## Working with incidents

To create a new incident manually, click **Create Incident** and fill in the fields: **Title**, **Description**, **Severity**, **Type**, **Status**, **Affected Data**, **Root Cause (optional)**, **Remediation (optional)**, **Lessons Learned (optional)**, **Data Breach**, and **Detection Time**.

As your team investigates, update the status to reflect progress:

1. **Open** — Incident detected, not yet investigated
2. **Investigating** — Team is actively working on the incident
3. **Contained** — Threat has been neutralized but resolution is in progress
4. **Resolved** — Root cause addressed and systems restored
5. **Closed** — Post-incident review complete, no further action needed

Each status change is logged with a timestamp and the user who made the change, creating a complete audit trail.

## Integrations that feed Incidents

Six integrations sync incidents into DSALTA:

| Integration     | What syncs                                                                                                                                                              |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Datadog**     | Incidents from Datadog Incident Management. Requires Incident Management to be enabled and an Application key with `incidents_read`.                                    |
| **Grafana**     | Currently-firing Grafana-managed alerts. A suppressed alert arrives as **Contained**; everything else is **Open**. Requires alerting read on the service-account token. |
| **ServiceNow**  | Records from the `incident` table — number, short description, description, priority, state and category.                                                               |
| **Sentry**      | Open Sentry issues, one incident per issue, type **Error**, severity derived from the issue level.                                                                      |
| **Freshdesk**   | Helpdesk tickets, with severity from the ticket priority and status from the ticket status.                                                                             |
| **Honeybadger** | Faults, each recorded with severity **Medium**. Resolved faults show **Resolved** and ignored faults show **Closed**.                                                   |

To connect an integration, go to **Integrations** in the DSALTA sidebar.

## Related pages

* [Vulnerabilities](/guides/data-library/vulnerabilities)
* [Changes](/guides/data-library/changes)
* [Integrations](/integrations/overview)