# Incidents

An **incident** is created automatically when a DQ monitor detects a threshold breach. Incidents are the primary signal for data quality issues in Telmai.

![](/files/yt217qKh3hUbXC8MPHFk)

***

## What an Incident Captures

* Which asset and [monitor type](/user-guide/monitor-types.md) triggered it
* Severity: `critical`, `high`, `medium`, or `low`
* The metric value at detection vs the configured threshold
* Detection timestamp
* Monitor configuration snapshot at the time of detection

***

## Incident Lifecycle

```
open → in_progress → resolved
```

| Status        | Meaning                                                                |
| ------------- | ---------------------------------------------------------------------- |
| `open`        | Newly detected, unacknowledged                                         |
| `in_progress` | Assigned to a team member, being investigated                          |
| `resolved`    | Closed (manually by a user, or automatically when the metric recovers) |

***

## Filtering Incidents

The Incidents page supports filtering by:

* Severity (`critical`, `high`, `medium`, `low`)
* Status (`open`, `in_progress`, `resolved`)
* Asset
* Monitor type
* Date range (detected at)

***

## Incident Detail

Clicking an incident shows:

* **Metric time-series chart** with the breach moment highlighted
* **Metric value** vs configured threshold
* **Monitor configuration** at time of detection
* **Event history**: status changes, assignee updates, notes

***

## AI Incident Correlation

Select multiple incidents and click **Correlate with AI**. Telmai analyzes the selected incidents and:

1. Groups related incidents by likely root cause
2. Assigns a confidence level (`high`, `medium`, `low`) to each group
3. Provides:
   * Why the incidents are related
   * The likely root cause
   * A recommended action

**Example output:**

> **Group: Upstream pipeline failure affecting Sales Analytics** (confidence: high) Both incidents detected within 15 minutes on related tables. The upstream ETL pipeline failed at 2:00 AM, causing downstream tables to not refresh. Recommended: check pipeline logs and restart the ETL job.

***

## Jira Integration

If [Jira is configured](/user-guide/administration.md#jira-integration), incidents can automatically create Jira tickets containing:

* Incident severity and status
* Asset name and monitor type
* Metric value vs threshold
* Link back to the Telmai incident

***

## Related

* [Monitor Types](/user-guide/monitor-types.md) — understand what triggers each incident type
* [Scan Jobs](/user-guide/scan-jobs.md) — when and how scans run
* [AI Copilot](/user-guide/copilot.md) — ask questions about incidents conversationally
* [DQ Report](/user-guide/dq-report.md) — see incident trends over time
* [API: Incidents](/api-reference/incidents.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://fabric-docs.telm.ai/user-guide/incidents.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.