Severity

Every Incident Management alert and incident carries a severity, one of:

sev1/sev2 page at high urgency, sev3/sev4 at low urgency — urgency selects which of a user's notification rule chains fires (e.g. "push immediately, SMS after 5 minutes" for high urgency vs. a slower, quieter chain for low). Severity also drives which of your outbound integrations receive the incident, if you route by minimum severity.

Where severity comes from

An incident's severity is either:

• Derived from its alerts (severityManual: false, the default) — the incident's severity is the highest (most critical) severity across every alert grouped into it. A new sev1 alert landing on an already-sev3 incident bumps the whole incident to sev1; the incident never quietly de-escalates as its most severe alert resolves.
• Set by a human (severityManual: true) — a manually created incident has no alert stream to derive severity from, so its creator sets it directly, and it stays sticky (the alert-derived max() logic never overrides it).

An alert source's payload mapping can map a vendor's own severity/priority field onto sev1–sev4 (with a configurable default for unmapped values), so an alert from Datadog, Grafana, or a custom webhook carries the right severity from the moment it's ingested.

Routing rules and channels

A routing rule or notification channel can specify a minSeverity — the incident must be at least this severe (this critical or worse) to trigger it. The default is sev2, so routine sev3/sev4 alerts don't, by default, reach every configured integration.