> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Module & Escalation Rules: Daily Use Guide

> OverviewWhen something critical happens, such as a new P1 ticket or an after-hours call, MSP Process opens an incident and alerts the person who is on call.…

## Overview

When something critical happens, such as a new P1 ticket or an after-hours call, MSP Process opens an incident and alerts the person who is on call. This article shows technicians and managers what to do when that alert arrives and how escalation behaves if nobody responds.

The pieces you will see:

1. **Incident:** the alert record, with a status of Open, Acknowledged or Resolved. It is separate from your PSA ticket.
2. **Escalation rule:** the timed list of who is alerted next if the incident stays Open.
3. **Notification group:** the list of people and their SMS, email and voice settings.
4. **On-call schedule:** the shift calendar that decides who in a group is alerted right now.

An admin in MSP Process will need to set these up. The [Admin Setup article](https://kb.mspprocess.com/msp-process/monitor-notify/incidents-alerts/escalation-rules-admin-setup-guide.md) covers that.

##

## Prerequisites

1. Your admin has completed the setup in the Admin Setup article, including a workflow that creates incidents and an escalation rule.
2. You are a member of a notification group, and you have a shift on the on-call schedule.
3. Your mobile number and email are correct in your profile or in your group entry, with SMS, email and voice turned on.
4. The MSP Process mobile app is installed and you are signed in, so you can acknowledge incidents from your phone.
5. Your phone allows calls and texts from unknown numbers, and Do Not Disturb is set to let them through during your shift.

To review more information on notification groups and contact methods, please review [Notification Groups: Admin Setup](https://kb.mspprocess.com/msp-process/monitor-notify/scheduling-on-call/notification-groups-admin-setup.md).

## How to use

### Step 1: Receive the alert

If you are on shift when an incident fires, you receive the channels set for your group, usually an SMS, an email and a voice call at the same time. The message carries the incident subject, often with the PSA ticket ID. If you are not on shift you are not contacted, even if you belong to the group.

###

### Step 2: Acknowledge the incident

Acknowledging assigns the incident to you and stops further escalation. Use any one of these:

1. **Voice call:** answer and press 1.
2. **Mobile app:** open the incident and select Acknowledge.
3. **Web:** go to **Monitor & Notify** → **Incidents** → **Alerts**, open the menu in the actions column and select Acknowledge.

**Note**: Replying to the SMS does not acknowledge the incident.

###

### Step 3: Work the issue

Do the work in your PSA. The incident is the alert and the PSA ticket is the work record.

If you assign the PSA ticket but the incident still shows Open in MSP Process, it will keep moving through the escalation steps, so ensure to acknowledge it in MSP Process too (step 2). Escalation ends after its last step. It does not repeat, so an unacknowledged incident stops alerting once every step has fired.

###

### Step 4: Close the incident

When you resolve or close the PSA ticket, the linked incident closes automatically if your administrator set up the close workflow. If not, set the incident to Resolved in **Monitor & Notify** → **Incidents** → **Alerts**.

###

### How escalation behaves

Escalation runs only while the incident is Open. Each step waits its delay and then notifies its group or person. Acknowledging stops the remaining steps.

An example after-hours P1:

| Time after creation | Who is notified | Channels |
| - | - | - |
| 0 min | Primary on-call, whoever is on shift | SMS, voice, email |
| 5 min, still Open | Primary on-call again | SMS, voice |
| 15 min, still Open | Secondary on-call, whoever is on shift | SMS, voice, email |
| 25 min, still Open | Service desk manager | SMS, voice |

Your own rule may use different delays. Ask your administrator for the exact steps.

### Check who is on call

Open the **On-call Schedule** calendar, select the notification group and switch to week view. Whoever holds the current time slot is the person the rule contacts for that group.

If you cannot cover a shift, use **Swap Shifts** to hand a date range to a colleague.

If your phone number or email changes, ask your administrator to update your entry in the notification group.

###

### Review Escalation Logs

Use the escalation log to see which steps fired for an incident, who was contacted and when. Check it after a missed alert, or to confirm an incident escalated as expected.

1. Go to **Monitor & Notify** → **Incidents** → **Alerts**.
2. Find the incident.
3. Use the status and priority filters, or search by the ticket ID in the subject.
4. Click the three dots in the Actions Column, and selection Escalation Log.

![](https://mintcdn.com/triggr/o9r5jEtjdR2oUtiW/images/msp-process-kb/e28bab3e8a38.webp?fit=max\&auto=format\&n=o9r5jEtjdR2oUtiW\&q=85\&s=4d5db9c9ac8bf4854762329d347a82be)

4. Review the escalation log. Read the entries in order.
5. Note which escalation rule fired, which step it reached, and which group or user was contacted on each channel.
6. Compare the times with the rule's delays. Each step should fire after its delay while the incident is still Open.
7. Look for the entry where the incident was acknowledged. Escalation stops there. If nobody acknowledged it, the log ends at the last step.

![](https://mintcdn.com/triggr/dXDzJtUmPBaHtkPV/images/msp-process-kb/f4a99dab3a1f.webp?fit=max\&auto=format\&n=dXDzJtUmPBaHtkPV\&q=85\&s=b7b99bc35062c92169459ef840174e1f)

If no entries appear, or the log shows no one was contacted, see the troubleshooting section below. If an incident should have triggered an escalation rule and notify your team, please include the incident ID and what the log shows when you contact support.

## Next steps

1. Ask your administrator to run a test incident while you are on shift so you know what each alert looks like.
2. Save the MSP Process support number and the sending number so you recognize the call.
3. Check the on-call calendar at the start of each rotation to confirm your shifts are correct.
4. Set up Swap Shifts with a colleague before planned time off.
5. Review the escalation log after an incident to see who was notified and when.

##

## Pitfalls

**Assigning the PSA ticket but not acknowledging the incident.**

1. The incident stays Open and escalates to the next person.

**Replying to the SMS.**

1. A text reply does not acknowledge anything. Press 1 on the call or use the app or web.

**Relying on the voice call for the ticket number.**

1. Voice may read the number as a quantity. Use the SMS or email for the exact ID.

**Do Not Disturb.**

1. A silenced phone can miss the alert. Allow calls and texts from the sending number during your shift.

**Out-of-date contact details.**

1. If your number changed, the alert goes to the old one until your group entry is updated.

**Unexpected cover.**

1. Only the person on shift is alerted. If you swap or leave a shift, make sure the calendar shows it.

**Direct users.**

1. A person added directly to a rule is alerted at any hour, regardless of the schedule.

##

## Troubleshooting common issues

**I was not alerted but I am in the group**

1. Open the On-call Schedule calendar, select your group and confirm you had a shift at that time.
2. Confirm your mobile number and email are correct and that SMS, email and voice are turned on for you.
3. Check your phone for blocked numbers and Do Not Disturb settings.
4. If all of that is right, tell your administrator.

**I got SMS and email but no call**

1. Confirm automatic voice calls are turned on for you.
2. Check that your phone is not blocking unknown numbers.
3. Tell your administrator. Voice calls can fail when a carrier blocks the sending number, and support can assign a different one.

**The incident keeps escalating after I started working it**

1. Open the incident in the app or in **Monitor & Notify** → **Incidents** → **Alerts**.
2. If the status is still Open, select *Acknowledge*.
3. Assigning the PSA ticket does not acknowledge the incident.

**The incident is still open after the PSA ticket closed**

1. Set the incident to Resolved in Alerts.
2. Tell your administrator so they can check the close workflow for that ticket type.

**I cannot see an incident in the app**

1. Pull to refresh and confirm you are signed in to the right account.
2. Check **Monitor & Notify** → **Incidents** → **Alerts** on the web.
3. If it is missing there too, tell your administrator. The app lists only incidents a workflow created.

**The alert went to the wrong person or team**

1. Open the escalation log for the incident and note which rule, group and schedule were used.
2. Send that information to your administrator.

##

## Reach out to support

If an alert did not arrive or an incident behaves unexpectedly, tell your administrator first, because they can check the rule, group and schedule. If they cannot resolve it, contact [MSP Process Support](https://kb.mspprocess.com/msp-process/how-to-articles/how-to-contact-support.md).

Please include the following information so our team can assist quickly:

1. The incident ID or ticket ID, and the date and time, with your time zone.
2. Who was on shift and who you expected to be alerted.
3. Which channels failed (SMS, voice, email or the app).
4. A screenshot of the incident and of the on-call calendar for that time.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.