Incident and Recovery confirmation

Incident confirmation

Incident Detection and Incident Confirmation are different moments. The first Failing Check starts the observed impact and a confirmation sequence; PointWarden opens an Incident only after three consecutive Failing Checks.

1. Failing Check 1 Incident Detection · Suspected Failure
2. Failing Check 2 Suspected Failure continues
3. Failing Check 3 Incident Confirmation · Incident opens as Unavailable

A Passing Check before Incident Confirmation resets the failure sequence to Available; no Incident opens.

Recovery confirmation

The first Passing Check during an open Incident marks when Recovery was observed and ends the observed impact, but the Incident remains open until a second consecutive Passing Check confirms Recovery.

1. Passing Check 1 Recovery observed · Recovering
2. Passing Check 2 Recovery confirmed · Incident closes as Available

A Failing Check while the Monitor is Recovering returns it to Unavailable and resets the Recovery sequence.

Notification timing

The Incident Notification Event becomes eligible after the third consecutive Failing Check; the Recovery Notification Event becomes eligible after the second consecutive Passing Check.

Notification delivery is separate from Endpoint Availability. An eligible event is delivered only to Notifiers that were Verified, Enabled, and subscribed to the event and Monitor at that moment. See Delivery evidence for that evidence layer.

Return to Check types to compare regular and confirmation work, or to the Owner quickstart to configure the Monitor and Notifier used in this sequence.