When we open an incident

Each completed check is a separate observation. The live result can show a failure before an incident opens, or a successful response while an incident remains open.

Incident records use a configured number of consecutive failed or successful checks. With a threshold above one, a single brief failure does not open a record by itself.

An automated incident opens when failures reach the configured threshold. It resolves after enough consecutive successful checks. This reduces repeated opening and closing when the result fluctuates.

The threshold does not tell us why a request failed, how many visitors were affected or whether other regions had the same problem.

The site team can also open or resolve a record manually, add updates and a postmortem note, or mark it as a reviewed false alarm.

A false-alarm annotation leaves the record visible with the correction. Our records and notes are independent observations, not official statements from Downdetector.