Incident icons

The 61 incident icons in DevOps, described

Action itemaction-item

A page with a box to tick — one thing someone agreed to do.

Alert fatiguealert-fatigue

The alarm bell with bars fading in it — so many alerts that none of them lands any more.

Change approvalchange-approval

A page with a ring seal on it — a change someone signed off.

Change requestchange-request

A page with a plus on it — a change asked for before it is made.

Chaos experimentchaos-experiment

A flask with lightning inside — a chaos experiment that injects failure on purpose.

Circuit closedcircuit-close

A switch blade bridging both contacts — a circuit breaker closed and passing traffic.

Circuit opencircuit-open

A switch blade lifted away from its contact — a circuit breaker tripped open.

Comms leadcomms-lead

A person with lines of text on the chest — the one who tells everyone else what is going on.

Contributing factorcontributing-factor

A page with two lines joining into one — something that helped it happen without being the cause.

Corrective actioncorrective-action

A page with an arrow that turns — a change made so this cannot happen the same way again.

Customer impactcustomer-impact

The incident machine with a person in it — who this incident is being felt by.

Degraded servicedegraded-service

The incident machine with a line falling in steps — up, but slower or worse than it should be.

Dependency outagedependency-outage

The incident machine with a line cut in the middle — something upstream is down.

Downtimedowntime

Downtime — the service is not answering, an outage while it is offline.

Error budget policyerror-budget-policy

A page with a coin on it — what the team does when the budget is spent.

Escalation policyescalation-policy

A page with a staircase on it — who is paged next when nobody answers.

Fault injectionfault-inject

Fault injection — break it yourself before the world does, a chaos test.

Flappingflapping

The alarm bell with a zigzag in it — an alert that fires, clears, and fires again.

Follow-up reviewfollow-up-review

A page with a clock on it — a check, weeks later, that the actions were done.

Freeze windowfreeze-window

A ring with a lock in it — a stretch of time in which nothing ships.

Full outagefull-outage

The incident machine with a cross — the service is down for everyone.

Shift handoffhandoff-shift

A ring with an arrow pointing both ways — the on-call duty passed from one person to the next.

Impact radiusimpact-radius

The incident machine with ripples around a point — how far the damage spreads.

Incidentincident

An incident — something is wrong in production and someone has to respond.

Close incidentincident-close

The incident machine with a check — an incident resolved and closed.

Incident commanderincident-commander

A person with a chevron on the chest — the one who runs the response.

Merge incidentsincident-merge

The incident machine with two lines joining into one — two reports found to be one incident.

Open incidentincident-open

The incident machine with a plus — an incident declared and given a number.

Incident reviewincident-review

A page with the incident bolt on it — the incident written up and read together.

Incident severityincident-severity

The incident machine with an exclamation mark — how bad this one is.

Incident timelineincident-timeline

The incident machine with a line and events either side of it — what happened, in order.

Maintenance windowmaintenance-window

A ring with a bracketed span in it — the agreed time for planned work.

Mitigationmitigation

The incident machine with a shield — the blow softened before the cause is known.

MTBFmtbf

A ring with two points and the gap between them — how long, on average, between failures.

MTTRmttr

A ring with a bolt and a check in it — how long, on average, from failure to fixed.

Noisy alertnoisy-alert

The alarm bell with an exclamation mark — an alert that fires often and means little.

On callon-call

On call — whoever is carrying the pager on the rota right now.

On-call swaponcall-swap

A person inside the rotation loop — the on-call rota turned so someone else takes the shift.

Acknowledge pagepage-ack

The alarm bell with a point in it — a page seen and taken by someone.

Escalate pagepage-escalate

The alarm bell with an arrow rising — a page nobody answered, sent up the chain.

Resolve pagepage-resolve

The alarm bell with a check in it — the page's cause is fixed and it stops ringing.

Snooze pagepage-snooze

The alarm bell with a Z in it — a page put off for a while.

Partial outagepartial-outage

The incident machine with one slash — down for some, up for the rest.

Postmortempostmortem

A postmortem — what went wrong, written down afterwards so the team can learn.

Retro boardretro-board

A window split in two with notes either side — what went well and what did not.

Risk assessmentrisk-assessment

A page with a hazard diamond on it — what could go wrong, and how badly.

Rollbackrollback-incident

The incident machine with an arrow pointing back — the change undone to stop the bleeding.

Root causeroot-cause

A page with a line that branches down into roots — the thing that, fixed, stops it happening again.

Runbookrunbook

A runbook — the written procedure for what to do when a system breaks.

Automated runbookrunbook-auto

An automated runbook — the incident page that runs itself at 3am.

Scribescribe

A person with a pen stroke on the chest — the one writing down what happens and when.

Self-healself-heal

Self-heal — cracked at noon and whole again by one, automatic repair.

Sev 1sev-one

The incident machine with three chevrons on a bar — the highest severity, everyone is paged.

Sev 3sev-three

The incident machine with one chevron on a bar — a minor incident, fixed in working hours.

Sev 2sev-two

The incident machine with two chevrons on a bar — serious, handled by the team on call.

Lower severityseverity-lower

The incident machine with an arrow dropping — an incident judged less bad than first thought.

Raise severityseverity-raise

The incident machine with an arrow rising — an incident judged worse than first thought.

Status pagestatus-page

A panel with a list whose bullets are lights — where customers see what is up and what is not.

Status updatestatus-update

A panel with an arrow rising in it — a note posted on how the incident is going.

Suppression rulesuppression-rule

A page with a pause on it — the alerts held back on purpose, and why.

War roomwar-room

A panel with two lines of talk in it — the channel where the incident is worked.

In code, each is one import — import { ActionItem } from "@iconmind/react/icons/action-item" — and the same name in Vue, Svelte, Solid, Preact, React Native, Astro, Blade and Flutter.

Narrow it by tag