# Work an incident
URL: /investigate/incidents
Find an incident, read its reconstruction across every source, inspect the events that matter and add them to the report. The workspace keeps the evidence, the order it supports and the report on one screen.
An incident is one failure under investigation, on one run of one vehicle. Its workspace puts every source on one timeline and shows where the vehicle was and which part recorded each event. The report sits one tab away. This page follows INC-0142 from the example dataset: a telemetry gap on UAS-04 after the kernel killed a perception process.
## Before you start [#before-you-start]
* Investigators and admins open and edit incidents. Reviewers read everything an investigator can, comment and approve reports. Viewers read approved reports and their evidence. See [Roles and permissions](/security/roles).
* The incident's run is imported and parsed. If its import status is anything but **Complete**, [check the run](/investigate/runs) first.
* Every time in the console is UTC.
## Find and open the incident [#find-and-open-the-incident]
Select **Incidents** in the sidebar. Its badge counts the incidents that are not closed.
The map at the top of the list carries the site name. It places a pin for each listed incident with a GPS track, where the vehicle was at the first finding. The pin carries the number alone, such as **0142**. The legend reads **Open**, **In review** and **Closed**. Hover a pin to highlight its row, or a row to highlight its pin. Select a pin to open the incident.
* The status buttons read **Active**, **Open**, **In review**, **Closed** and **All**, each with a count. **Active**, the default, shows every incident that is not closed.
* The search box, **Filter by title, vehicle or ID**, matches the incident ID, title, vehicle and run as you type.
* The vehicle list starts at **All vehicles**.
A count line gives the number of matches. The filters are part of the page address, so a filtered view can be bookmarked or sent to a colleague. The table lists the most recently updated incident first.
| Column | What it shows |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Incident** | The title, then the ID and where it happened: INC-0142, Route Iron, return leg |
| **Platform** | The vehicle and its run: UAS-04, run R-0931 |
| **First finding** | The earliest rule result and its time: Memory above threshold, 14:32:01 UTC, 24 Sep |
| **Sources** | Four glyphs: flight log, companion journal, process samples and ground receive log. A dimmed glyph's tooltip reads, for example, **Ground receive log: not imported** |
| **Clock** | **Aligned ±46 ms**, **Manual ±1.09 s**, **Not aligned**, **Elapsed time only** or **Pending** |
| **Status** | **Open**, **In review** or **Closed** |
| **Owner** | The investigator who owns the incident |
| **Updated** | The last change, such as **4 min ago** or **Yesterday** |
Select the row or the pin. The page title is the incident ID and title. At the right sit the status button, which shows a colored dot and the current status, and **Export**. On the **Report** tab, **Review and history** joins them, and on **Activity**, **People** with the number of people on the case.
The context strip under the title reads, for INC-0142:
| Card | INC-0142 |
| ---------------------- | --------------------------------------------------------------- |
| **Platform** | UAS-04, Q4 recon quad. Opens the vehicle page |
| **Where** | Route Iron, return leg, `13R FP 7640 8765` |
| **Run** | R-0931, Route Iron recon, leg 2. Opens the run page |
| **Incident window** | 14:31:53 to 14:32:16Z, 24 Sep 2026, 23 s |
| **Clock** | **Aligned ±46 ms**, 4 sources |
| **Owner and reviewer** | The investigator who owns the incident, then the named reviewer |
Four tabs follow: **Reconstruction**, **Sources**, **Report** and **Activity**. **Sources** carries the number of files, **Report** its state (**Draft**, **In review** or **Approved**) and **Activity** its number of entries.
## Open a new incident [#open-a-new-incident]
Open one when a run shows a failure worth an investigation of its own.
Select **New incident** at the top right of **Incidents**. From a run page, **Open an incident** does the same with that run chosen; it shows on runs that are **Complete** or **Partial** and have no incident yet.
The dialog's note: "One failure under investigation, on one run. The report starts as a draft with nothing concluded."
| Field | What to enter |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Run** | Any run that is **Complete** or **Partial**. The hint counts its rule results, such as **1 rule result becomes the first event.**, or reads **No rule results on this run, so the timeline opens empty on its first two minutes.** |
| **Title** | What failed, in plain words |
| **Owner** | You, by default |
| **Reviewer** | Who signs off the report. The owner cannot review their own report. |
Select **Open incident**. The incident takes the next ID, such as **INC-0144**, with the status **Open**, and its workspace opens. Each rule result on the run becomes an event on the lane of the source that recorded it, and a finding. The window spans the results with 20 s either side, or the first two minutes of the run when there are none. The report starts as a **Draft** whose finding reads **Unknown** until you write it.
The toast reads, for example, **INC-0144 opened on R-0930**. The audit log records **Opened incident**, and with the Generic webhook (HMAC) on, a `case.opened` event goes to its receiver.
## Read the reconstruction [#read-the-reconstruction]
The **Reconstruction** tab opens first. Its panels run one under the other, each the full width of the page. From the top:
1. The clock note, which says how far the sources can be compared.
2. The timeline: one lane per source, with the findings above them. See [Read the timeline](/investigate/timeline).
3. **Where**, the map, when the run has a GPS track. It follows the timeline window, the pointer and the selected event. See [Read the map](/investigate/map).
4. **Findings**, every rule result in time order, 8 to a page. Select one to select its event.
5. **On the vehicle**, the evidence diagram, subtitled **Where each event happened. Numbers follow the report.** Under the drawing, **Evidence chain** reads the report's events from part to part, left to right, and its foot gives where the chain starts, where a link was lost and how it ends. See [Vehicles and parameter drift](/investigate/vehicle#the-evidence-diagram).
6. **Events in view**, a table of the events inside the timeline window, 25 to a page.
7. The evidence inspector, a drawer that slides in from the right edge of the screen when you select an event, over the page rather than beside it.
### The clock note [#the-clock-note]
| Note | When it appears | Button |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| **All** *N* **sources are on one timeline** | Every source is anchored. The note gives the widest bound between two sources and says whether any events are closer than their combined clock error | **Show the pair** or **Show the first pair**, when such pairs exist |
| **One source, anchored to GPS time** | Only a flight log was imported, so no order between sources is claimed | None |
| **The companion clock was never synchronised** | The companion journal and process samples have no anchor. They keep their own clock, with no before or after claim against the flight log | **Align from matching events** |
| **Companion clock aligned by hand** | An engineer applied a manual alignment. The note gives the offset and its bound | **Remove alignment** |
INC-0142 reads: "The widest bound between two sources is ±46 ms. 5 pairs of events are closer than their combined clock error, so their order is not claimed." **Show the first pair** zooms to the last `obstacle_distance` sample and the kernel kill, 39 ms apart against a 46 ms combined bound. It also selects the sample. The report counts only the pairs inside its own sequence, so INC-0142's report lists one.
For the two companion clock notes, see [Align a clock by hand](/investigate/align-a-clock).
### Events in view [#events-in-view]
The subtitle counts the events in the window, such as **20 events in 23 s**. **All events** and **Findings** switch between every event and the rule results alone.
| Column | What it shows |
| ------------- | --------------------------------------------------------------------------------------------------------------------- |
| **Time, UTC** | The event time to the millisecond |
| **Bound** | The event's clock error, such as ±6 ms |
| **Source** | The lane, such as Companion journal |
| **Event** | The title, in bold for a finding. Journal events carry a priority dot: red for priority 3 or more severe, amber for 4 |
| **Rule** | The rule ID and version, such as `process_exit 1.2` |
| **ID** | The eight-character event ID, such as `5a705b4a` |
Companion events on an unaligned clock come last, after the row **Companion clock, not aligned. Times below are on the companion’s own clock.** Their times show in amber and their bound reads **no anchor**.
## Select an event and add it to the report [#select-an-event-and-add-it-to-the-report]
Select an event in any of these places:
* its tick on the timeline, or a flag in the **Findings** row (a flag that groups several findings zooms in instead);
* its row in **Events in view**;
* its numbered marker on the map, or its numbered badge on the vehicle diagram;
* its row under **Order against nearby events** in the inspector of another event.
← and → step through the events on the same clock, in time order. Esc closes the inspector.
The inspector shows the event's time and bound, its position, its file, location and SHA-256, the original record and the order against nearby events. For a finding, it adds the rule. [Inspect an event](/investigate/event) describes each block.
The page address gains `?e=` and the event ID, so a link to it opens with the same event selected. Each time the inspector shows an event, the audit log records **Viewed evidence** with the event's title.
Select **Add to report** at the foot of the inspector. The event joins the report's sequence, and the button changes to **In the report**.
Foxborne confirms with **Added to the report sequence**. The report history gains **Added an event to the sequence**, and the audit log records **Edited report** with **Sequence, added** and the event ID.
## Dismiss a finding [#dismiss-a-finding]
Dismiss a finding you judge expected, such as a restart during a scheduled bench test. The raw evidence does not change.
Select the finding. Its **Rule** block in the inspector lists **Rule**, **Detects**, **Threshold** and **Wording**.
Select **Dismiss this finding** and write the **Reason**. The field is required: left empty, it turns red and the dialog stays open.
Select **Dismiss finding**. Foxborne confirms with **Finding dismissed. The evidence is unchanged.**
The flag leaves the **Findings** row and its count. The inspector adds a **Dismissed** chip and reads **Dismissed by**, followed by your name and reason. The audit log records **Dismissed finding** with the rule and the reason.
## Change the status [#change-the-status]
The status button opens a menu: **Open**, **In review** and **Closed**. A new status shows a message such as **INC-0142 is now in review**. It also adds **Set the status to in review** to the Activity tab and records **Changed status** in the audit log.
The incident status and the report state are separate. The report keeps its own **Draft**, **In review** or **Approved**: see [Write and review a report](/investigate/write-a-report).
## Sources and Activity [#sources-and-activity]
**Sources** lists the run's files with their clocks, anchors, bounds and hashes. Below them sit the ordering bounds between each pair of sources and how each bound is built. It is the same view as on the run page: see [Check a run](/investigate/runs#check-the-source-files).
**Activity** is the incident's feed, newest first, under **Imports, rule results, edits and views. The same entries are in the audit log.** Each entry names who acted and when, such as 24 Sep 15:02. Entries by Foxborne itself carry a bolt, as in **Foxborne** rules produced 6 findings (13 rules, 0.9 s). Status changes, manual clock alignments and exports add entries here. The [audit log](/security/audit-log) holds the complete record, including every view of the evidence.
## Check the result [#check-the-result]
* The event you added appears on the **Report** tab under **2 Sequence**, with an evidence reference such as E3.
* The inspector's button reads **In the report**.
* **History**, in the report's **Review and history** drawer, lists **Added an event to the sequence** with your name.
* A dismissed finding shows **Dismissed** in the inspector and no longer has a flag on the timeline.
## Troubleshoot [#troubleshoot]
**No incidents match.** The console adds **Clear the filters to see every incident.** Set the status to **All** and clear the search box.
**This incident does not exist.** The console adds "It may have been deleted under the retention policy." Check the ID, or see [Retention, holds and redaction](/security/retention). **Back to incidents** returns to the list.
**No events in this window.** The timeline window holds no events. Zoom out, or drag the window in the whole-run strip.
**The inspector shows Own clock and no position.** The event sits on a companion clock that never synchronized, so it has no place on the UTC axis or on the track. [Align the clock by hand](/investigate/align-a-clock) if a matching pair of events exists.
**A row reads Order unknown.** The two events are closer than their combined clock error. Foxborne makes no before or after claim between them, and the report says so. See [Alignment and event order](/concepts/alignment).
## Next [#next]
Lanes, brackets, order-unknown overlaps and zoom.
Every block of the inspector and the event page.
Finding, sequence, limitations and approval.
Put an unsynchronized companion clock on UTC.