An incident is unexpected service or platform behavior that negatively affects function or performance. It also includes a recurrence whose previous lessons have not yet been applied. section 7.1
Manage an incident through three connected phases:
- Detect abnormal behavior through health and performance monitoring. section 7.1
- React in a structured way, assigning a human responder—often through an on-call mechanism—to contain the problem and restore service. section 7.1.2 section 7.4
- Learn afterward by identifying action items, applying previous lessons, and using a runbook when a known problem recurs. section 7.1 section 7.4
A distributed-service failure
Users experience unusually slow responses or partial failures in a cloud-native application. Monitoring detects the abnormality, the responsible on-call engineer investigates and contains it, and a later blameless postmortem records improvements. Because many services may own parts of the request path, communication may require a separate incident manager or commander. section 7.0 section 7.1.2 section 7.4
