How to Use incident.io: The Beginner’s Guide (First Incident, the Roles Lesson, and the Postmortem Arc)

CodexFuse Team · 2026-11-02T04:12:00.855Z · 12 min read min read

What Is incident.io, Exactly?

incident.io is the incident management platform you run from inside Slack or Microsoft Teams: when something breaks, you declare an incident with a slash command, and the platform builds the incident channel, assigns the roles, and writes the timeline for you. The vendor's own one-liner calls it "the all-in-one platform for on-call, incident response, Investigations and status pages," and this guide teaches how to use incident.io end to end: install, your first tutorial incident, declaring a real incident, the roles lesson, the timeline, and the postmortem arc. One mental model carries the whole product: an incident in incident.io is a Slack workflow — declare, assign roles, track actions, and the busywork handles itself.

One boundary first, said once: if the problem is deciding WHO gets woken up, that is alerting — our ilert beginner guide covers alert sources and escalation policies. incident.io picks up after the page lands: coordinating the response, running the incident, and writing the postmortem. Before-the-page versus after-the-page — two tools, two lanes, and this incident.io for beginners guide stays in the after-the-page lane.

How Do You Install incident.io?

You install incident.io on your chat platform, not on a server — the vendor says you pick Slack or Microsoft Teams and "you'll be up and running in minutes." This incident.io Slack walkthrough assumes the Slack path and notes the Teams differences as they come. On Slack, sign in with Slack through the vendor's installation guide; on Microsoft Teams, follow the Teams installation guide. You will need a Slack admin for the workspace step, and the install creates an #incidents channel where new incidents get announced.

Teams is fully supported, but cover both paths honestly: the Teams bot takes no slash commands, so on Teams you declare incidents, escalate, and assign roles from the dashboard instead of typing /inc. Everything below that shows a slash command has a dashboard equivalent on Teams. If Slack itself is new to your team, our Slack beginner guide covers channels, threads, and pins first.

What Are incident.io's Four Products?

Four products share the one platform, and it helps to know which one you are using:

This guide is a Response guide. On-call, status pages, and Investigations appear where they touch a beginner's first week.

What Is the Fastest Way to Learn incident.io?

Type /inc tutorial in any Slack channel — this incident.io tutorial is a five-minute guided tour that covers the basics of declaring and running an incident. Do this before you touch a real incident; it is the cheapest possible way to learn the declare flow, the roles, and the timeline.

Learning is free at incident.io, said once because it matters: teammates who go through the tutorial flow are not considered Responders — the vendor's word for paid users — so the whole company can practice without anyone getting billed for learning.

How Do You Declare Your First Real Incident?

From any Slack channel, type /incident or /inc — incident.io opens a declare modal, and submitting it builds the incident. Follow this seven-step arc for your first one, taken from the vendor's own beginner walkthrough:

1. Type /incident Oh no! — the modal opens; submit it as-is for now. incident.io creates the incident channel plus an internal incident homepage.
2. Assign yourself as lead — /incident lead me (or /incident lead @person). The lead is the single most important early action.
3. Write the first summary — /incident summary. It shows in the announcement channel, the homepage, and the timeline at once.
4. Rename the incident — the channel name and homepage title update together, so future-you can find it.
5. Set the severity — the vendor notes that "a bunch of things happen automatically" here: your configured workflows fire off the severity.
6. Set the status — /incident status fixing tells everyone which phase the incident is in.
7. Pin the key messages — pin any message in the incident channel and it lands in the timeline.

Three declare routes cover every situation: the slash command above, turning any Slack message into an incident from the three-dots menu ("create an incident"), or the declare button in the dashboard. On Teams, use the dashboard — the bot does not take slash commands.

/incident Oh no!      # declare from any channel
/inc tutorial         # free 5-minute guided tour
/incident test        # sandbox dry run
/inc lead me          # take the lead role
/incident summary     # post the first update
/incident status fixing
/incident follow-up   # track a follow-up action
/inc escalate         # page up the escalation path
/inc retro            # record an incident after the fact

What Is the Incident Lead, and Who Else Do You Need?

Only two roles are built in: the Incident Lead, which always exists and cannot be removed, and the Reporter, which is automatically whoever declared the incident. The Incident Lead coordinates the response and drives it to resolution — everything else your team defines:

Roles live in Settings → Incident Roles. Each role gets a name, a Slack reference shorthand — for example /inc role comms @bea assigns the comms role — and instructions that get DM'd to whoever takes the role. "Lead" and "commander" are reserved shorthands, and roles can be scoped to specific incident types or auto-filled by workflows: whoever acknowledges an escalation can become the Incident Lead automatically. Use /inc roles to list roles, /inc role [role] [@user] to assign one, or the "Make me lead" quick action on the welcome message.

How Does the Incident Timeline Actually Fill Itself?

incident.io records most timeline events automatically — the declaration, role assignments, severity changes, status updates, and more — and you add the human parts by pinning: pin any Slack message in the incident channel and it appears in the timeline. The machine events plus your pinned decisions are the raw material the postmortem writes itself from later.

The practical lesson is one sentence: pin the decisions as they happen, not at the end. A timeline reconstructed from memory the next morning is how "why did we do that?" questions survive into the postmortem.

Tutorial, Test, Real, Retrospective: Which Incident Mode Do You Need?

incident.io has four incident modes, and picking the right one keeps practice and testing out of your production history:

The rule of thumb: tutorial to learn, test to rehearse, real when something is actually wrong, retrospective when the incident happened before incident.io was in the loop.

Can You Create Incidents from Code and CI?

Yes — incidents do not have to start in chat. The vendor's API lets monitoring tools like Datadog or ticket systems like Zendesk create incidents directly: generate a key in Settings → API keys, fetch your severity configuration first (severities are custom to each organization, so you look up their IDs), then POST with an idempotency key, a severity ID, and a visibility of public or private. The idempotency key is what keeps a retried request from creating a duplicate incident.

There is also inc, the official open-source CLI at github.com/incident-io/inc: inc auth login opens a browser flow that lasts 28 days, every command emits JSON when piped, and inc describe prints a machine-readable command schema the vendor built with LLM agents in mind. If you want your pipelines to open incidents, our GitHub Actions beginner guide covers the CI side of the setup.

How Much Does incident.io Cost?

incident.io has a free-forever Basic plan, paid Team and Pro tiers, and Enterprise on a custom quote — with on-call sold as a separate add-on. The vendor's pricing page showed these figures when this guide was written; plan prices move, so treat the numbers as a snapshot and check the pricing page before you budget:

On-call is the add-on: +$10/user/month on Team, +$20/user/month on Pro, or a standalone on-call-only product at $20/user/month with alert routing, schedules, shadow rotations, holiday calendars, cover requests, and live call routing. Investigations, the AI root-cause agent, is an add-on on Pro and Enterprise. The vendor page shows no trial terms and no stated seat cap on Basic — do not assume limits that are not printed.

How Does incident.io Handle On-Call?

On-call is how the incident.io on-call product answers the before-the-page half: alert routing, on-call schedules, and escalation paths that notify the right person when something needs attention. Escalation policies are flowchart-style, with if-else conditions that route by priority, time of day, and more, and manual escalation from Slack is /inc escalate — on Teams, escalate from the dashboard instead.

On-call sits under the same platform as response, so the two halves connect: an acknowledged escalation can auto-fill the Incident Lead role in the incident it creates, and the catalog ties Feature → Team → Escalation Path so picking an affected feature pages the right team.

How Do Postmortems and Follow-Ups Work?

The post-incident half is where the timeline pays off. Create a follow-up with /incident follow-up in the channel or from the incident's Post-incident tab; paste an issue-tracker link into the channel and incident.io offers to attach it as a follow-up. Follow-ups export to your issue tracker with two-way sync on title, description, status, owner, and labels, and auto-export can route every follow-up to the right project. A dashboard Follow-ups page shows them across every incident, with filters, bulk edit, and reminders.

Write the postmortem in the incident.io postmortem editor — plain editing on Team, AI-native drafting on Pro — then export to Notion, Google Docs, Confluence, or SharePoint from the Post-incident tab. You can ship multiple documents per incident, like an internal postmortem plus a customer-facing RCA, and workflows can auto-export on completion. Export destinations are configured in Settings → Post-mortems.

incident.io vs PagerDuty: What's Actually Different?

Both products cover the on-call-to-resolution arc, but they start from opposite ends. incident.io describes itself as the all-in-one platform for on-call, incident response, Investigations, and status pages — with the response experience living natively in Slack and Teams, and on-call sold as a separate add-on. PagerDuty grew up as the alerting and on-call platform. If your pain is "who gets paged and how the escalation works," compare the alerting side carefully; if your pain is "our Slack incident channels are chaos," incident.io's response lane is the thing to evaluate.

7 Mistakes Beginners Make with incident.io

Sources

1. incident.io docs — What is incident.io (getting started)
2. incident.io docs — Incident modes
3. incident.io docs — Manual incidents (on-call)
4. incident.io docs — Incident roles
5. incident.io docs — Priority, urgency, and severity
6. incident.io docs — Follow-ups
7. incident.io docs — Creating your first incident using the API
8. incident.io docs — Using the incident.io CLI
9. incident.io — Pricing page
10. incident.io Notion — Creating your first incident (beginner guide)

Frequently Asked Questions

Is incident.io free for beginners?

Yes. The Basic plan is free forever, and the /inc tutorial command runs a free five-minute guided tour of the basics. Teammates who go through the tutorial flow are not counted as Responders, the vendor's term for paid users, so the whole team can practice without billing surprises.

How do I declare an incident in Slack?

Type /incident or /inc from any channel to open the declare modal. You can also turn any Slack message into an incident from the three-dots menu ("create an incident"), or use the declare button in the incident.io dashboard.

Does incident.io work with Microsoft Teams?

Yes — Teams gets native incident response just like Slack, with one difference: the Teams bot does not take slash commands, so you declare incidents, escalate, and assign roles from the dashboard instead of typing /inc.

What is the difference between a test incident and a tutorial incident?

The tutorial incident (/inc tutorial) is a five-minute guided tour that teaches the basics. A test incident (/incident test) is a sandbox for dry runs and automation testing — it is not announced in #incidents and is excluded from the incident library and Insights.

Can incident.io replace PagerDuty?

For the response half — Slack-native coordination, roles, timelines, and postmortems — incident.io is purpose-built. On-call is a separate add-on, so evaluate the alerting and escalation side on its own terms before deciding it covers your paging needs.