Work an incident

An incident is one failure under investigation, on one run of one vehicle. Its workspace puts every source on one timeline and shows where the vehicle was and which part recorded each event. The report sits one tab away. This page follows INC-0142 from the example dataset: a telemetry gap on UAS-04 after the kernel killed a perception process.

Before you start#

• Investigators and admins open and edit incidents. Reviewers read everything an investigator can, comment and approve reports. Viewers read approved reports and their evidence. See Roles and permissions.
• The incident's run is imported and parsed. If its import status is anything but Complete, check the run first.
• Every time in the console is UTC.

Find and open the incident#

1. 01

   Open the Incidents list

   Select Incidents in the sidebar. Its badge counts the incidents that are not closed.

   The map at the top of the list carries the site name. It places a pin for each listed incident with a GPS track, where the vehicle was at the first finding. The pin carries the number alone, such as 0142. The legend reads Open, In review and Closed. Hover a pin to highlight its row, or a row to highlight its pin. Select a pin to open the incident.

2. 02

   Filter the list

   • The status buttons read Active, Open, In review, Closed and All, each with a count. Active, the default, shows every incident that is not closed.
   • The search box, Filter by title, vehicle or ID, matches the incident ID, title, vehicle and run as you type.
   • The vehicle list starts at All vehicles.

   A count line gives the number of matches. The filters are part of the page address, so a filtered view can be bookmarked or sent to a colleague. The table lists the most recently updated incident first.

   Column	What it shows
   Incident	The title, then the ID and where it happened: INC-0142, Route Iron, return leg
   Platform	The vehicle and its run: UAS-04, run R-0931
   First finding	The earliest rule result and its time: Memory above threshold, 14:32:01 UTC, 24 Sep
   Sources	Four glyphs: flight log, companion journal, process samples and ground receive log. A dimmed glyph's tooltip reads, for example, Ground receive log: not imported
   Clock	Aligned ±46 ms, Manual ±1.09 s, Not aligned, Elapsed time only or Pending
   Status	Open, In review or Closed
   Owner	The investigator who owns the incident
   Updated	The last change, such as 4 min ago or Yesterday

3. 03

   Open the incident

   Select the row or the pin. The page title is the incident ID and title. At the right sit the status button, which shows a colored dot and the current status, and Export. On the Report tab, Review and history joins them, and on Activity, People with the number of people on the case.

   The context strip under the title reads, for INC-0142:

   Card	INC-0142
   Platform	UAS-04, Q4 recon quad. Opens the vehicle page
   Where	Route Iron, return leg, 13R FP 7640 8765
   Run	R-0931, Route Iron recon, leg 2. Opens the run page
   Incident window	14:31:53 to 14:32:16Z, 24 Sep 2026, 23 s
   Clock	Aligned ±46 ms, 4 sources
   Owner and reviewer	The investigator who owns the incident, then the named reviewer

   Four tabs follow: Reconstruction, Sources, Report and Activity. Sources carries the number of files, Report its state (Draft, In review or Approved) and Activity its number of entries.

Open a new incident#

Open one when a run shows a failure worth an investigation of its own.

1. 01

   Start from the list or the run

   Select New incident at the top right of Incidents. From a run page, Open an incident does the same with that run chosen; it shows on runs that are Complete or Partial and have no incident yet.

2. 02

   Fill in the dialog

   The dialog's note: "One failure under investigation, on one run. The report starts as a draft with nothing concluded."

   Field	What to enter
   Run	Any run that is Complete or Partial. The hint counts its rule results, such as 1 rule result becomes the first event., or reads No rule results on this run, so the timeline opens empty on its first two minutes.
   Title	What failed, in plain words
   Owner	You, by default
   Reviewer	Who signs off the report. The owner cannot review their own report.

3. 03

   Open it

   Select Open incident. The incident takes the next ID, such as INC-0144, with the status Open, and its workspace opens. Each rule result on the run becomes an event on the lane of the source that recorded it, and a finding. The window spans the results with 20 s either side, or the first two minutes of the run when there are none. The report starts as a Draft whose finding reads Unknown until you write it.

   The toast reads, for example, INC-0144 opened on R-0930. The audit log records Opened incident, and with the Generic webhook (HMAC) on, a case.opened event goes to its receiver.

Read the reconstruction#

The Reconstruction tab opens first. Its panels run one under the other, each the full width of the page. From the top:

1. The clock note, which says how far the sources can be compared.
2. The timeline: one lane per source, with the findings above them. See Read the timeline.
3. Where, the map, when the run has a GPS track. It follows the timeline window, the pointer and the selected event. See Read the map.
4. Findings, every rule result in time order, 8 to a page. Select one to select its event.
5. On the vehicle, the evidence diagram, subtitled Where each event happened. Numbers follow the report. Under the drawing, Evidence chain reads the report's events from part to part, left to right, and its foot gives where the chain starts, where a link was lost and how it ends. See Vehicles and parameter drift.
6. Events in view, a table of the events inside the timeline window, 25 to a page.
7. The evidence inspector, a drawer that slides in from the right edge of the screen when you select an event, over the page rather than beside it.

The clock note#

INC-0142 reads: "The widest bound between two sources is ±46 ms. 5 pairs of events are closer than their combined clock error, so their order is not claimed." Show the first pair zooms to the last obstacle_distance sample and the kernel kill, 39 ms apart against a 46 ms combined bound. It also selects the sample. The report counts only the pairs inside its own sequence, so INC-0142's report lists one.

For the two companion clock notes, see Align a clock by hand.

Events in view#

The subtitle counts the events in the window, such as 20 events in 23 s. All events and Findings switch between every event and the rule results alone.

Companion events on an unaligned clock come last, after the row Companion clock, not aligned. Times below are on the companion’s own clock. Their times show in amber and their bound reads no anchor.

Select an event and add it to the report#

1. 01

   Select the event

   Select an event in any of these places:

   • its tick on the timeline, or a flag in the Findings row (a flag that groups several findings zooms in instead);
   • its row in Events in view;
   • its numbered marker on the map, or its numbered badge on the vehicle diagram;
   • its row under Order against nearby events in the inspector of another event.

   ← and → step through the events on the same clock, in time order. Esc closes the inspector.

2. 02

   Read the inspector

   The inspector shows the event's time and bound, its position, its file, location and SHA-256, the original record and the order against nearby events. For a finding, it adds the rule. Inspect an event describes each block.

   The page address gains ?e= and the event ID, so a link to it opens with the same event selected. Each time the inspector shows an event, the audit log records Viewed evidence with the event's title.

3. 03

   Add it to the report

   Select Add to report at the foot of the inspector. The event joins the report's sequence, and the button changes to In the report.

   Foxborne confirms with Added to the report sequence. The report history gains Added an event to the sequence, and the audit log records Edited report with Sequence, added and the event ID.

Dismiss a finding#

Dismiss a finding you judge expected, such as a restart during a scheduled bench test. The raw evidence does not change.

1. 01

   Open the finding

   Select the finding. Its Rule block in the inspector lists Rule, Detects, Threshold and Wording.

2. 02

   Give the reason

   Select Dismiss this finding and write the Reason. The field is required: left empty, it turns red and the dialog stays open.

3. 03

   Confirm

   Select Dismiss finding. Foxborne confirms with Finding dismissed. The evidence is unchanged.

   The flag leaves the Findings row and its count. The inspector adds a Dismissed chip and reads Dismissed by, followed by your name and reason. The audit log records Dismissed finding with the rule and the reason.

Change the status#

The status button opens a menu: Open, In review and Closed. A new status shows a message such as INC-0142 is now in review. It also adds Set the status to in review to the Activity tab and records Changed status in the audit log.

The incident status and the report state are separate. The report keeps its own Draft, In review or Approved: see Write and review a report.

Sources and Activity#

Sources lists the run's files with their clocks, anchors, bounds and hashes. Below them sit the ordering bounds between each pair of sources and how each bound is built. It is the same view as on the run page: see Check a run.

Activity is the incident's feed, newest first, under Imports, rule results, edits and views. The same entries are in the audit log. Each entry names who acted and when, such as 24 Sep 15:02. Entries by Foxborne itself carry a bolt, as in Foxborne rules produced 6 findings (13 rules, 0.9 s). Status changes, manual clock alignments and exports add entries here. The audit log holds the complete record, including every view of the evidence.

Check the result#

• The event you added appears on the Report tab under 2 Sequence, with an evidence reference such as E3.
• The inspector's button reads In the report.
• History, in the report's Review and history drawer, lists Added an event to the sequence with your name.
• A dismissed finding shows Dismissed in the inspector and no longer has a flag on the timeline.

Troubleshoot#

No incidents match. The console adds Clear the filters to see every incident. Set the status to All and clear the search box.

This incident does not exist. The console adds "It may have been deleted under the retention policy." Check the ID, or see Retention, holds and redaction. Back to incidents returns to the list.

No events in this window. The timeline window holds no events. Zoom out, or drag the window in the whole-run strip.

The inspector shows Own clock and no position. The event sits on a companion clock that never synchronized, so it has no place on the UTC axis or on the track. Align the clock by hand if a matching pair of events exists.

A row reads Order unknown. The two events are closer than their combined clock error. Foxborne makes no before or after claim between them, and the report says so. See Alignment and event order.

Next#