Tools · Incident response playbooks · 22 / 23
The severity field is a label, not the evidence
The severity value on a ticket is the label someone assigned. Impact still has to be written as facts: who is affected, what is down, what data is in question. Changing the label does not change those facts.
The field is a choice
A ticket can show SEV-2 or another word from the team’s scale. That word is the classification stored on the record. It was chosen by a person or a rule. It is not a log line, and it is not a count of hosts.
Two tickets can share a severity and describe different facts. The label does not make them the same incident.
The facts sit beside the label
Write who reported it, which systems are named, and what those systems’ logs actually show. If a fact is missing, write “not recorded.” Do not let the severity word stand in for the missing fact.
Raising or lowering the field is a new classification. It does not edit the evidence you already attached.
What to write down
File the severity as a label, the time it was set, and the facts that were known then. If you change it later, file the new label and the new fact that prompted it. Do not file only the new number.
Lab: SEV-2 with no affected system
IR-2026-014 is marked SEV-2. The description says “possible account issue” and names no system, no user, and no log. A draft tells leadership that two systems are down because SEV-2 means that on the poster in the lab.
The note quotes SEV-2 as the label and says affected systems were not recorded. The poster’s example is not this ticket. Leadership is not told that systems are down.
ticket: IR-2026-014 severity: SEV-2 (label) facts recorded: none beyond the phrase “possible account issue” affected systems: not recorded write: label plus the gap not: two systems down
Diagram
What a severity word cannot replace
The label is the classification. The facts are still required.
- Severity field
The word stored on the ticket. A label.
- Affected systems
Names from the ticket or the logs. Not implied by the word.
- A later edit
A new label. It does not rewrite attached evidence.
- A wall poster
The team’s examples. Not this incident’s facts.
Check yourself
1. A ticket says SEV-2 and names no system. What is SEV-2?
2. You lower the severity after a log shows one lab account. What else must the note contain?
3. Two tickets are both SEV-2. What follows?