# Triage in the inbox

> Working the inbox day to day — its groups, filtering, keyboard shortcuts, and reading an incident.

Web page: https://infrainbox.app/docs/incidents/triage/

## The Inbox

The **Inbox** (dashboard screen `/incidents`) shows everything that still needs a decision, grouped by what you do next:

- **Needs you** — open incidents nobody has taken yet.
- **Acknowledged** — someone has it; repeats don't alert.
- **Snoozed** — quiet until the snooze ends.
- **Recently resolved** — folded away; **Show** opens the last 20, and **Show more** goes further back. Each group's count is how many incidents it is listing.

Each incident is one row of two lines: its severity and title with how many events it has gathered (`×14`), then its source and what state it is in ("flapping", "acknowledged 5m ago", "snoozed until 12:00"). Within a group the loudest come first, then the newest to open.

The Inbox lists what needs a person; everything that arrived, whatever became of it, is in **Activity** (dashboard screen `/events`) instead.

## Filtering

The box at the top narrows every group at once. Plain words match the title, the source and the resource. Two prefixes do more:

| Type | Finds |
|---|---|
| `sev:crit` | Incidents of that severity (the first letters are enough) |
| `source:proxmox` | Incidents from sources whose name contains it (spaces ignored) |

The filter is part of the address, so a filtered Inbox is a link you can share or bookmark. Press `/` to jump to the box, and `Esc` to leave it.

## Live updates

The Inbox updates itself as events arrive. A row's count, time and state change where it stands, but rows don't move under you: when an incident resolves, comes back, is acknowledged elsewhere or is new, a bar at the top says so, for example "“Backup failed on pve2” is resolved". Press **Update list** to put everything where it now belongs. Your own actions move their row straight away. If the pill at the top right says **Reconnecting…** instead of **Live**, the Inbox is not hearing about new events; it catches up once the pill turns green again.

## Reading an incident

On a wide screen the chosen incident sits beside the list; the Inbox opens on the first one. On a phone the list and the incident take turns, and **← Inbox** goes back.

It starts with one sentence: how bad it is (and how bad it got, if that was worse), what state it's in and since when, how many events, and who was told — naming any destination a notice failed to reach, even when others heard. An incident whose source was deleted says so rather than reading as a manual resolve. Below the actions, **What happened** is its whole story, newest first, in one list:

- the events that make it up, as the source sent them, with any recovery marked;
- every state change, who made it and from where (the web, the app, Telegram, the API);
- every notice, to which destination, and whether it was sent, skipped or failed.

**Deliveries and full details** opens the incident's full page, with the deliveries table and a **Retry** for a failed one.

## Actions

From the buttons beside the incident, a keyboard shortcut, or the full page's **Actions** menu: **Acknowledge**, **Snooze** (for an hour, four hours, until 08:00, or a time you pick), **Resolve** (asked first). See [How incidents work](https://infrainbox.app/docs/incidents/how-incidents-work.md) for exactly what each one does. A heartbeat-owned incident whose monitor is still down offers **Pause monitor** in place of Resolve. **Mute** quiets the incident's source for a while.

After an action a short message says what happened; for acknowledge, unacknowledge and snooze it offers **Undo** for a few seconds. Resolving has no undo.

## Keyboard shortcuts

With the Inbox open and nothing else capturing keys (no dialog open, not typing into a field):

| Key | Does |
|---|---|
| `j` | Choose the next incident |
| `k` | Choose the previous incident |
| `e` | Acknowledge it |
| `s` | Snooze it for an hour |
| `x` | Resolve it (asks first) |
| `w` | Unsnooze it |
| `u` | Undo the last action, while its message shows |
| `/` | Filter |

Moving stops at either end rather than wrapping around.

## The command palette

**⌘K** (macOS/iOS) or **Ctrl K** opens a search box over areas, sources and your open incidents, so you can jump to one without paging through the list. It stands aside while a dialog is already open or you're typing into a field.

## From the phone

Acknowledge, snooze and resolve all work the same way from a paired phone as from the web dashboard — they're the same actions, over the same API, so a change made on one shows up on the other within moments. See [iPhone app and push](https://infrainbox.app/docs/notifications/mobile-app.md).