Incidents
The Incidents screen at app.igrisecurity.com/incidents surfaces security events that require review. Denials, anomaly detections, and session-level events all flow into a single queue so your team has one place to triage.Anomaly detections appear here — there is no separate Anomaly dashboard screen. The Anomalies tab on this page is where you find and action them.
Incident categories
Tabs
Four tabs filter the incident list:
Each tab label shows the count of incidents matching that category in the current result set.
Filters and search
The toolbar below the tabs provides additional scoping:
Press Clear to reset all filters.
Incident list
Incidents are sorted by status (open → investigating → resolved), then by severity (critical → high → medium → low → info), then by most-recently-seen. Each row shows:- Severity badge
- Title and summary
- Category
- Connection slug
- Actor name
- First seen / last seen timestamps
- Current status
Incident detail drawer
The drawer opens from the right and shows:- Incident metadata — title, summary, severity, category, status, first/last seen, connection, actor
- Policy — the policy and rule that triggered the incident (if applicable)
- Impact counters — blocked events, allowed events, and redacted events linked to this incident
- 12-hour pulse — hourly bar chart of linked events over the past 12 hours
- Linked audit events — a paginated list of the raw
mcp.toolorllm.callevents that were grouped into this incident
https://app.igrisecurity.com/incidents?id=<uuid> loads the drawer directly for that incident.
Triage actions
Three status transitions are available from the drawer:
These actions map to
PATCH /api/v1/incidents/:id with { status, resolution_note }.
Severity
Severities are assigned automatically by the incident clustering logic. They can be overridden via the API by patchingseverity. Once a severity is manually set it is locked and will not be overwritten by future clustering.