---
title: 'Massive incident management'
description: 'Managing incidents that span many assets — automatic correlation, the incident lifecycle, the operational dashboard and post-incident review.'
section: 'Operations Center'
weight: 13
related:
  - evidence-and-correlation
  - operational-issues
---

import Image from '@/components/docs/Image.astro';

A Massive Incident is a set of interrelated Operational Issues that share a common cause.

This allows large operational events to be analyzed as a single management object.

## Incident Correlation

OHM automatically groups Operational Issues into a Massive Incident when several factors match:

- time of occurrence;
- region;
- Root Cause;
- communication infrastructure;
- software version;
- an external event.

## Massive Incident Lifecycle

```mermaid
flowchart TD
    A["Detection"] --> B["Correlation"]
    B --> C["Massive Incident Created"]
    C --> D["Investigation"]
    D --> E["Mitigation"]
    E --> F["Recovery"]
    F --> G["Verification"]
    G --> H["Post Incident Review"]
    H --> I["Closure"]
```

<Image
  src="/images/operations-center/12-incident-lifecycle-light.webp"
  srcDark="/images/operations-center/12-incident-lifecycle-dark.webp"
  alt="Massive incident timeline view showing the incident progressing through its lifecycle stages from detection to post-incident analysis."
  caption="Mass incident with its own lifecycle: Detected → Confirmed → Investigation → Mitigation → Resolved → Post-Analysis"
  width={1440}
  height={900}
/>

## Operational Dashboard

For each Massive Incident, the system displays:

- the number of related Operational Issues;
- the number of assets;
- the affected regions;
- the presumed Root Cause;
- the investigation status;
- the SLA;
- the business impact;
- the current recovery progress.

<Image
  src="/images/operations-center/13-incident-dependency-graph-light.webp"
  srcDark="/images/operations-center/13-incident-dependency-graph-dark.webp"
  alt="Incident card with a dependency graph linking dozens of symptom issues across assets back to a single root cause node."
  caption="Incident card: dependency graph — dozens of symptoms, one cause"
  width={1440}
  height={900}
/>

## Post Incident Review

After closure, the incident undergoes analysis.

The report includes:

- the timeline;
- the confirmed Root Cause;
- response effectiveness;
- SLA compliance;
- Lessons Learned;
- recommendations for preventing recurrence.

All conclusions can be automatically converted into Knowledge Base articles.