Architecture · 25 min
Alert & Incident Architecture
What does each part of the Golden Flow actually do?
First we saw the whole machine. Now we open the hood on each component.
Flow reference
Machine-initiated
- Monitoring / Integration
- Alert
- Routing
- Team
- Escalation Policy
- On-Call Schedule
- Responder
- Incident — when warranted
Human-initiated
- Agent / Portal
- Service Offering
- Incident — Standard or Major
- Responders / On-Call
- Coordination
- Resolution
- PIR
Architectural Design Principle
- Service
- Team
- Escalation
- Schedule
- People
Build the operating model around stable organizational structures. People change. The service and response model should remain understandable and maintainable.
Highlighted concept
ALERT ≠ INCIDENT
Components
Each component below follows the same shape: what it is, where it fits, why it matters, an admin best practice, and the mistake to avoid.
What it is
Monitoring and external systems detect events and send operational data into Jira Service Management.
Why it matters
Everything downstream inherits the quality of the signal. A noisy integration guarantees a noisy operating model no matter how good the routing and escalation design is.
Common sources
- Cloud monitoring
- Network monitoring
- Application monitoring
- Observability platforms
- Security tools
- Custom integrations
- API-based integrations
What it is
An alert indicates that something requiring attention may have occurred.
Why it matters
Alerts are the operational signal layer. Treating every alert as incident-worthy work is the fastest route to alert fatigue.
An alert may
- Require acknowledgement
- Be routed to responders
- Trigger escalation
- Be grouped with related alerts
- Lead to creation of an incident
What it is
Teams represent stable operational ownership boundaries — for example Network Operations, Application Support, Cloud Platform, Database Operations or Security Operations.
Why it matters
Team ownership is the most durable structure in the model. People change roles; the boundary should not.
What it is
Routing determines which team or response path owns an incoming alert.
Why it matters
Routing is where most 'the wrong people got paged' problems originate, and where they are cheapest to fix.
Routing in sequence
- Incoming alert
- Conditions evaluated
- Appropriate team
- Escalation process begins
What it is
Escalation policies define how the response should progress when an alert is not acknowledged or acted upon — for example notify the primary on-call, then after X minutes the secondary, then the team lead or fallback team.
Why it matters
Escalation is the safety net for the response path. Its behaviour should be consistent and reusable across teams.
What it is
Schedules determine who is responsible at a particular time.
Why it matters
The schedule is the only place staffing reality should need to be expressed. Everything else can stay stable.
Schedule concepts
- Rotations
- Coverage periods
- Overrides
- Holidays
- Handoffs
- Primary and secondary coverage
What it is
Responders are the people or teams actively participating in the response.
Why it matters
Administrators need to distinguish three different ideas that often get collapsed into one.
Three distinct concepts
- Assigned operational ownership — who owns the service or alert long term
- On-call responsibility — who is accountable right now
- Incident responders — who is actively working this specific incident
What it is
A service represents a business or technical capability — Payment Processing, Customer Portal, ERP, Microsoft 365, Network Connectivity, Identity Services.
Why it matters
Services connect technical events to understandable business ownership and reporting context.
Services provide
- Ownership
- Context
- Incident association
- Operational understanding
- Reporting context
- Business impact understanding
What it is
Service offerings provide a user-facing operational entry point into a service. For a Payment Processing service that might be 'Report Payment Processing Incident', 'Report Payment Processing Major Incident' or 'Request Payment Processing Support'.
Why it matters
The offering is where a person meets the operating model. It should describe the business process, not the technical implementation behind it.
What it is
An incident represents coordinated work to restore service or address an interruption.
Why it matters
Incidents are where investigation, communication and resolution are managed — and where Jira workflow, responders and PIR come together.
Incident concepts
- Standard incident
- Major incident
- Responders
- Affected service
- Communications
- Investigation
- Resolution
- Post-incident review
Live demos
- Team
- Escalation
- Schedule
- Current on-call responder