---
title: "Severity"
description: "Incident Management uses a four-level sev1–sev4 scale that drives paging urgency, escalation speed, and which notification rule chain fires."
---

Every Incident Management alert and incident carries a **severity**, one of:

| Severity | Meaning | Urgency |
|---|---|---|
| `sev1` | Critical | High |
| `sev2` | Error | High |
| `sev3` | Warning | Low |
| `sev4` | Info | Low |

`sev1`/`sev2` page at **high urgency**, `sev3`/`sev4` at **low urgency** — urgency selects which of a user's notification rule chains fires (e.g. "push immediately, SMS after 5 minutes" for high urgency vs. a slower, quieter chain for low). Severity also drives which of your outbound integrations receive the incident, if you route by minimum severity.

## Where severity comes from

An incident's severity is either:

- **Derived from its alerts** (`severityManual: false`, the default) — the incident's severity is the highest (most critical) severity across every alert grouped into it. A new `sev1` alert landing on an already-`sev3` incident bumps the whole incident to `sev1`; the incident never *quietly* de-escalates as its most severe alert resolves.
- **Set by a human** (`severityManual: true`) — a [manually created incident](/api/incident-management/create-incident) has no alert stream to derive severity from, so its creator sets it directly, and it stays sticky (the alert-derived `max()` logic never overrides it).

An alert source's [payload mapping](/api/incident-management/alert-sources) can map a vendor's own severity/priority field onto `sev1`–`sev4` (with a configurable default for unmapped values), so an alert from Datadog, Grafana, or a custom webhook carries the right severity from the moment it's ingested.

## Routing rules and channels

A routing rule or notification channel can specify a `minSeverity` — the incident must be at least this severe (this critical or worse) to trigger it. The default is `sev2`, so routine `sev3`/`sev4` alerts don't, by default, reach every configured integration.