> ## Documentation Index
> Fetch the complete documentation index at: https://help.rekkeh.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Severity and Statuses in Rekkeh

> Explore Rekkeh incident severity levels, emergency status transitions, list filters, and the default 5-minute emergency SLA.

Rekkeh uses severity levels and lifecycle statuses to help your security team prioritize work and track incidents and emergencies from start to finish. This page explains the definitions and rules that govern how records move through the system.

## Incident severity levels

Every incident is assigned a severity level. Severity affects filtering, sorting, and escalation rules.

| Severity     | Definition                                | Response expectation                            |
| ------------ | ----------------------------------------- | ----------------------------------------------- |
| **Low**      | Minor issue with no immediate risk        | Review during normal operations                 |
| **Medium**   | Moderate concern or repeat nuisance       | Follow up within the same shift or business day |
| **High**     | Significant risk, damage, or safety issue | Investigate immediately and involve supervisors |
| **Critical** | Active threat, breach, or major harm      | Immediate response and executive notification   |

<Note>
  Emergency alerts do not use the same severity scale. They have their own status lifecycle with time-sensitive transitions.
</Note>

## Emergency statuses and transitions

Emergencies use a fixed set of statuses. The stored status in Rekkeh maps to a Gate Ops label that responders see in the field.

| Stored status  | Gate Ops label   | Meaning                                   |
| -------------- | ---------------- | ----------------------------------------- |
| `triggered`    | **New**          | Emergency declared, broadcast in progress |
| `broadcasting` | **Broadcasting** | Notifications are actively being sent     |
| `acknowledged` | **Acknowledged** | At least one responder confirmed          |
| `in_progress`  | **In Progress**  | Response actions underway                 |
| `resolved`     | **Resolved**     | Threat contained or event ended           |
| `closed`       | **Closed**       | Final review complete, archived           |

## Allowed status transitions

Emergencies must move through statuses in order. The allowed transitions are:

* `triggered` to `broadcasting`
* `broadcasting` to `acknowledged`
* `acknowledged` to `in_progress`
* `in_progress` to `resolved`
* `resolved` to `closed`

<Warning>
  Once an emergency is closed, it cannot be reopened. If follow-up work is needed, create a linked incident or a new emergency.
</Warning>

## Incident list filters

In the Estate Admin dashboard you can filter the incidents list by:

| Filter       | Options                                           |
| ------------ | ------------------------------------------------- |
| **Status**   | Open, Acknowledged, In progress, Resolved, Closed |
| **Severity** | Low, Medium, High, Critical                       |
| **Source**   | Member App, Gate Ops, Admin-created               |

Combine filters to narrow the exact queue you are working. For example, filter by **Open** + **High** + **Critical** to see the highest-priority unreviewed items.

## Emergency SLA

Rekkeh tracks response time from trigger to first acknowledgment. The default target is **5 minutes**.

Admins can see SLA performance in the emergency timeline and in historical reports. Missed SLA events are flagged automatically for review.

<Tip>
  Filter incidents by severity and status daily to keep the queue manageable and ensure nothing stays in Open past its expected window.
</Tip>