​

How to Work with the Incident Manager Workflow

​

Incident Manager Page

The Incident Manager page is the central place where all incidents are listed. Filter incidents by various criteria to manage and prioritize them effectively. At the top of the Incident Manager page, four cards summarize Open Incidents, Resolved Incidents, Response Time, and Resolution Time. Below them, the page lists incidents with the test case name, table, last updated time, status, severity, and assignee.

​

Filters Available:

• Test case: Filter incidents associated with specific test cases.
• Assignee: View incidents assigned to specific team members.
• Status: Filter incidents based on their current status (for example, New, ACK, Assigned, or Resolved).
• Date Filter and Date Range: Choose a date field, such as Created at, and a range of dates.

​

Triage Incidents with the API

In OpenMetadata 2.1, three API changes help you triage many incidents at once.

​

Group Open Incidents

GET /v1/dataQuality/testCases/testCaseIncidentStatus/incidentGroups groups open incidents by one of three dimensions:

• table
• testDefinition
• owner: a test case with several owners counts once for each owner.

Narrow the groups by open status, current assignee, test case, domain, and a createdAt or updatedAt date range. A request for the Resolved status returns a 400 error, because only open incidents are grouped. Sort groups by incident count, ascending or descending, and page through results with cursors. Each group returns:

• incidentCount: the number of incidents in the group.
• severity: the most critical severity in the group.
• status: one status for the group, ranked Assigned, then Ack, then New. A group with any assigned incident shows Assigned.
• assignees and assigneeCount: who the incidents are assigned to.
• firstSeen and lastSeen: when an incident in the group first and last occurred.
• trend: eight time buckets and a direction of Rising, Falling, or Steady.

​

Drill Into a Group

The incident list endpoint accepts three new filters, to list the incidents behind a group:

• testDefinition
• owner: the direct user or team owner of the test case.
• assignee

An unknown filter value returns a 404 error. Incidents created in OpenMetadata 2.1 also store a failureSummary. Incidents created before OpenMetadata 2.1 don’t have one.

​

Update Many Incidents at Once

PUT /v1/dataQuality/testCases/testCaseIncidentStatus/bulk changes the status, the severity, or both for up to 100 incidents per call. The call runs immediately, and checks permissions and validity for each incident separately. The response reports success or failure for each incident, so one failure doesn’t stop the others.

​

Incident Status Change

Incident status can be updated to reflect the current stage of the incident resolution process. The owner of the incident has the ability to assign it to an appropriate assignee for further action.

​

Steps to Change Incident Status:

1. Navigate to Observability > Incident Manager.
2. Select the incident that needs a status update.
3. Click the Edit icon next to Incident Status.
4. Select a Status and an Assignee.
5. Click Save.

​

Incident Resolution

Once an incident has been resolved, it can be officially closed. Ensure to describe a Root Cause Analysis (RCA) in the comments to provide context and understanding of the resolution process.

​

Steps to Resolve and Close an Incident:

1. Verify that all necessary steps to resolve the incident have been completed.
2. Describe the RCA in the resolution comments.
3. Change the status of the incident to ‘Resolved’.
4. Confirm the closure to update the incident in the list.

​

Incident Activities

Each incident includes a detailed timeline where all relevant information is consolidated. This timeline provides a comprehensive view of the incident’s lifecycle, including key events, RCA documentation, and closure updates.

​

How to View Incident Activities:

1. Open the incident from the Incident Manager page.
2. Navigate to the ‘Incident’ tab within the incident details.
3. Review the chronological events, RCA, and closure updates associated with the incident.

​

Set Up Alerts for Incident Activity

To receive notifications when an incident is created, updated, commented on, or assigned, configure an alert with Source = Task. Incidents in OpenMetadata are Task threads with task type RequestTestCaseFailureResolution. Alert sources are matched by thread type, not task type — so if you configure an alert with Source = Conversation, it will never fire for incidents.

​

Steps to Create an Incident Alert

1. Navigate to Settings > Notifications > System.
2. Select Add Notification.
3. Set Source to Task.
4. (Optional) Add a Mentioned User or Team filter to limit alerts to incidents where a specific person or team is @-mentioned.
5. Select your Destination — Slack, MS Teams, email, or internal OpenMetadata users.
6. Save the alert.

For a full reference of alert source entities and their available filters, see System & Governance Notifications.