Incident Response Sankey Diagram: Editable Template
Follow monitoring alerts through triage into noise, false positives, minor and major incidents, and show who resolves each. Replace the example counts with your own.
An incident response Sankey follows alerts from the monitor to the person who resolves them. It shows how much of the alert volume is noise and how much escalates.
Of 2,000 alerts in the example period, over half are closed automatically. Of the 900 investigated, 400 are false positives and 500 are real incidents, 140 of which are escalated to a specialist team.
The picture is for reviewing the process, not for assessing individuals. Replace the counts with your incident tool's export.
How to read this diagram
- 1,100 of 2,000 alerts (55%) are noise; another 400 are false positives after investigation.
- 500 real incidents: 380 minor and 120 major.
- 100 of the 120 major incidents are escalated, against 40 of 380 minor ones.
- The on-call engineer resolves 360 incidents; the specialist team 130; 10 remain open.
The data behind it
Invented figures for illustration. Not data about any real business.
| From | To | Amount (alerts) |
|---|---|---|
| Alerts | Auto-closed as noise | 1100 |
| Alerts | Investigated | 900 |
| Investigated | False positive | 400 |
| Investigated | Minor incident | 380 |
| Investigated | Major incident | 120 |
| Minor incident | Resolved by on-call | 340 |
| Minor incident | Escalated | 40 |
| Major incident | Resolved by on-call | 20 |
| Major incident | Escalated | 100 |
| Escalated | Resolved by specialist team | 130 |
| Escalated | Still open | 10 |
The same data as CSV
source,target,value
Alerts,Auto-closed as noise,1100
Alerts,Investigated,900
Investigated,False positive,400
Investigated,Minor incident,380
Investigated,Major incident,120
Minor incident,Resolved by on-call,340
Minor incident,Escalated,40
Major incident,Resolved by on-call,20
Major incident,Escalated,100
Escalated,Resolved by specialist team,130
Escalated,Still open,10How it works
Export alerts and incidents for a period
Include severity, outcome and who resolved each.
Add the triage result
Noise, false positive, minor or major.
Add escalation and resolution
Who resolved it, and what is still open.
Check the balance
Escalated should equal specialist-resolved plus still open.
Frequently asked questions
What if an incident is escalated and then handed back?
Keep to the final resolver, or add a return flow. The editor draws a flow that returns to an earlier node as a return flow.
Can I use this for security alerts?
Yes, for counts moving through categories. It is a reporting picture, not a detection tool.
Edit this incident Sankey
Open the example as your own chart and enter your alert counts.