> For the complete documentation index, see [llms.txt](https://support.incidentlake.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.incidentlake.com/release-notes.md).

# What's new

What you can do now in Incident Lake — written for the people who use it every day.

This page is for your team, not for a changelog. Each entry explains the **benefit** of a recent change — what is easier, faster, or newly possible — and where to do it.

{% hint style="info" %}
If a word on the screen does not match these pages, an Administrator may have renamed it under **Settings → Project → Terminology**. The steps are the same.
{% endhint %}

{% updates format="full" %}
{% update date="2026-11-03" tags="incidents,settings" %}

## Take requests from the whole company, keep track of every device, and record the fields your organization needs

This update brings everyday IT service work into Incident Lake: orders, questions, and the devices people use. It adds three pages, **Service requests**, the **Self-service portal**, and **IT assets**, and lets you add your own fields to incidents.

### Order accounts, access, and equipment from a catalog

**Service requests** is new under **Service management**. The service desk publishes items such as *New laptop* or *VPN access*, each with its own form, approvers, and checklist of fulfilment tasks. Members choose an item, fill in the form, and follow the request from **My requests**. Approvers find what is waiting for them under **Approvals**, and an item can need no approval, any one approver, or all of them. Once approved, the fulfilment tasks are ticked off one by one, and **Mark as fulfilled** tells the requester it is done. Every step is in the request's history, and nobody can approve their own request.

See [Service requests](/service-management/service-requests.md).

### One front door for questions and problem reports

The **Portal** in the sidebar is for everyone in your organization, Viewers included. People search the knowledge you chose to publish, and when that does not answer it, they report a problem or ask a question about a service in the catalog. While they type, related articles are suggested, and a service with an issue already being worked on says so, so people know it is already being handled. Requesters follow the conversation, confirm and rate the result, or reopen it if it is not fixed.

Your team works these in **Portal requests**, with assignment, a resolution, and work notes the requester does not see. **Raise as incident** turns a report into an incident and links the two. In Knowledge, **Publish on portal** chooses which entries appear; nothing is published until you turn it on.

See [Self-service portal](/everyday-tools/self-service-portal.md).

### A register of laptops, phones, and other IT assets

**IT assets** under **Service management** keeps every device with its user, location, purchase details, warranty, and a full change history. Cards at the top show at a glance what is in use, in stock, near the end of its warranty, or not seen for 30 days. Bring an existing spreadsheet in with **CSV**, in Japanese or English and in Shift\_JIS for Excel; a file with any error imports nothing and lists the rows to fix.

Connect **Jamf Pro** under **Settings → Integrations**, and the Macs, iPhones, and iPads it manages appear in the register and stay up to date every 6 hours. What your team enters, such as the asset tag or the warranty, is never overwritten, and nothing is changed in Jamf Pro. On an incident, link the lost laptop or the affected PC under **Affected IT assets**.

See [IT assets](/service-management/it-assets.md) and [Integrations](/settings/integrations.md#jamf-pro).

### Add the fields your organization records on every incident

Administrators add fields such as the number of affected users, the site, or a customer ID under **Settings → Workflow → Incident custom fields**, as text, numbers, dates, choices, checkboxes, or links. A field can apply to some categories only, and can be **Required to close**, so an incident cannot be closed until it is filled in. Responders fill the fields in on the incident page, and exports include them as columns.

See [Workflow](/settings/workflow.md#incident-custom-fields) and [Work an incident](/incidents/work-an-incident.md#custom-fields).

### Problems from drills, and more for AI tools and the Public API

When a drill's debrief is generated, each risk it finds is opened in **Problem Management** with a **Drill** badge, without waiting for someone to accept each one. See [Problem Management](/service-management/problems.md#register-a-problem).

AI tools connected over MCP now start with the everyday tools, such as incidents, notes, and tasks, and find the rest when they need it, so they pick the right tool more reliably. If your AI tool says Incident Lake cannot do something, ask it to search Incident Lake's tools. See [AI tools (MCP)](/settings/ai-tools.md#how-the-connection-behaves).

The Public API now covers the task board, workflow automations, emergency chat, and the review of AI-filled incident fields.
{% endupdate %}

{% update date="2026-11-02" tags="chat,incidents" %}

## Keep the specification next to the incident, run team tasks in one board, and let the AI fill the record while you keep the final say

This update adds two new pages, **Specifications** and **Task board**, and makes the incident page do more of the typing for you.

### Settle "bug or specification?" from the written specification

**Specifications** is new in the sidebar. Keep what each product or service is supposed to do in a space of pages, the way a wiki does. Import the documents and support pages you already have, and the AI writes them up as specification pages without summarizing them. Everything the AI writes arrives as a **Draft**; a person chooses **Confirm as correct** before it becomes **Official**, and only official text counts as the specification. Space owners are notified about Drafts waiting for review, and **To review** gathers them in one place.

During an incident, the new **Spec or bug** tab judges the behavior against the official text and tells you whether it is **As specified**, a **Bug**, a **Spec gap**, or a **Spec defect**, citing the pages it read. The conclusion flows into the postmortem draft, and you can propose the fix to the specification from the same place. Questions and change proposals live in **Discussions**; a merged proposal becomes official, and **Estimate impact** tells you how big a change is before you agree to it. **Check for contradictions and gaps** reads a whole space and lists what disagrees or is missing.

See [Specifications](/everyday-tools/specifications.md).

### One board for the work that outlives an incident

The **Task board** replaces the separate **Improvement Tasks** page. Create a project such as *Recurrence prevention*, add tasks with a title and Enter, and work them as a **List**, a **Board** by status, or a **Schedule**. Tasks have comments with files and pasted images, a number such as **T-12**, up to 20 linked incidents, and the same due-date reminders as incident tasks. **My tasks** gathers your project tasks, incident tasks, and open AI suggestions in one list.

The improvement suggestions Incident Lake makes are now the **AI suggestions** inbox on the board. **Make a task** turns one into an ordinary task, and the suggestion is completed when the task is. Corrective actions on a problem are board tasks too, and an incident's **Tasks** tab lists the board tasks that follow up on it. Bring tasks over from Jira, Asana, or Backlog with **Import CSV**: the columns are recognized, assignees are matched by email or name, and a file can be imported again without duplicates. Turn on **Use planning tools** for scopes with a recorded plan, prerequisite tasks, and effort points.

See [Task board](/service-management/task-board.md).

### A chat room on the incident, for when Slack or Teams is down

Every incident has an **Emergency Chat** tab. Choose **Open emergency chat** and invite responders; they get an email, an in-app notification, and a browser push with the link. Anyone who can view the incident can **Join chat** without an invitation. The room runs inside Incident Lake, so it keeps working when other chat tools do not. Close it when the incident is over and the history stays on the record. People active in the room are not pinged, and others hear at most once every five minutes.

In every chat in Incident Lake, Enter now adds a new line and **⌘/Ctrl + Enter** sends, so a half-written message is not sent by accident. This applies to the emergency chat, the AI chat, the intake chat on a new incident, and the support chat.

See [Work an incident](/incidents/work-an-incident.md#emergency-chat).

### Let the AI fill the incident record, and confirm it in one click

The incident page now fills empty fields from the notes, the chat, and similar past incidents: severity, category, impact and urgency, affected services, the response timestamps, and roles. Choose **Fill with AI**, or let it run in the background. Each value is marked **unverified** with its reason until you choose **Mark verified**, and an AI-filled severity does not page anyone until a person confirms it. When a later note or a sanity check disagrees with a value someone set, the field is marked **Action required** with the suggested change; choose **Change** or **Keep as is**. The incident list shows an **AI unverified** badge and an **Action required** badge, with filters for both.

See [Work an incident](/incidents/work-an-incident.md#fields-filled-in-by-ai).

### Tell the assistant what to read

Under the chat title, **Sources** shows what the assistant uses for this conversation. Choose **Add source** to pin incidents, specification spaces or pages, evidence documents, or knowledge tags, and remove any of them, including an incident linked earlier. A pinned page is read before every answer, and a pinned document is searched for every question. **What this chat is about** marks the conversation as **Incident response**, **Specification check**, **Report drafting**, or a **General question**, and you can switch it as the conversation moves on.

See [Chat](/everyday-tools/chat.md#choose-what-the-assistant-reads-from).

### A completed self-assessment opens a problem

When a member completes an assessment in the Incident Lake Self Assessment app, a problem is opened in **Problem Management** with an **Assessment** badge. Its description is a snapshot of the result, with the grade per category and the items scored lowest, so the follow-up work has a home. Each assessment item now also shows concrete examples of what "in place" looks like, so people who are not incident-management experts can score consistently.

See [Problem Management](/service-management/problems.md#register-a-problem).
{% endupdate %}

{% update date="2026-10-30" tags="chat,incidents,settings" %}

## Give everyone a role, send the routine messages automatically, and follow an emergency plan hour by hour

This update is about who does what on an incident, the messages that always go out, and the large events, such as disasters and system-wide outages, that need more than one team.

### Run incidents with your own roles

Under **Settings → Project → Incident Roles**, Administrators define the roles your organization uses, such as Incident Commander or scribe, with a description, an order, and whether each one is required. On a new incident, the **Roles** tab lists every role. A role can have several people and a person can hold several roles, and the assignment history is kept. If a required role is still empty when you create the incident or change its status, Incident Lake warns you but does not stop you. Incidents created from Slack or Teams start with roles filled in from what the thread already says, and nothing is guessed when the thread is silent.

Incidents created before this update keep the Incident Commander view they had.

See [Incident roles](/settings/incident-roles.md).

### Build "when this happens, do that" yourselves

**Workflow automations** on **Settings → Workflow** run when an incident is created, when its status changes, or when its severity changes. A workflow can post to a Slack channel, send email to people or mailing lists, and phone an on-call schedule, in up to five steps run top to bottom. A condition such as "SEV-2 or worse" runs once, at the moment the incident crosses it. Messages can include the incident name, link, status, and severity. Start from a template such as **Escalate to leadership at SEV-1**, and open **Runs** to see each step's result on the canvas.

Changes are checked every minute, so a workflow can take up to a minute to run. Changes made before you switched a workflow on, and drill incidents, never trigger it. Administrators create and edit workflows. Phoning on-call needs the on-call add-on.

See [Workflow](/settings/workflow.md#workflow-automations).

### Follow what each team does, hour by hour, in an emergency

**Emergency response** is new under **Readiness & reporting** in the sidebar. Before anything happens, register each team's or organization's response plan (BCP, procedure, or action card) as steps timed from the onset, each with an owner and the page it came from. You can type the steps in, or let the AI extract draft plans and contacts from documents in the Evidence Library. Every extracted item cites its document and page, and nothing is used until someone approves it.

When something happens, choose **Activate a response** and enter what happened, when, and where. The approved plans that match are preselected, and their steps are laid out from the first hour to the first week. Track progress and notes on each step, and late steps are highlighted. For a typhoon landfall or a planned outage, activate with the expected time, and the steps to take beforehand are shown first.

On **Ask for a contact**, describe the problem and get up to three contacts from your approved list, with the reason for each. Phone numbers are shown exactly as registered. If lives are at risk, call the emergency services first. Extraction and consultations use AI credits.

See [Emergency response](/everyday-tools/emergency-response.md).

### Choose whom the phone call goes to, and how to brief them

On the incident's **Page on-call by phone**, you can now pick **Specific members** as well as an on-call schedule. Only that person is called, with no hand-off to anyone else. In **How to deliver it**, write something like "Customer impact first, keep it short" or "Always ask whether we may roll back", and the assistant follows it for the briefing and the conversation. It is treated as a request, not as a fact about the incident, and it is never read out. You can try it in a rehearsal call first.

Under **Settings → Project → On-call**, each person's phone number now has a call language: their account language, Japanese, or English.

Calls also feel more natural. The briefing starts as soon as the person answers, replies come faster, and the assistant no longer reads out keypad instructions or repeats what it has already said. Keys 1 and 2 still work.

See [On-call](/settings/on-call.md).

### Find the page in a PDF even when the wording is different

Evidence Library search now matches by meaning as well as by keywords. A page that is close in meaning but has none of your search words is labeled **Related in meaning**. Chat answers, and the summary, timeline, and postmortem drafts for an incident, now read the Evidence Library and list the pages they used as Sources in the form 「title」p.N. Drafts look first at documents linked to the incident's services.

See [Evidence Library](/everyday-tools/evidence-library.md).

### Bring up to ten incidents into one chat

When you pick incidents for a chat, you can filter by status, severity, category, service, and tag, group them, and select a whole group at once. Turn on **Search by content** to find incidents by what they are about. You can now select up to **ten** incidents instead of five.

Similar-incident search and task suggestions also work on incidents that are still being worked and have no summary or timeline yet. Incident Lake uses their notes, tasks, and Slack or Teams messages instead.

See [Chat](/everyday-tools/chat.md).

### Ask for help without leaving Incident Lake

Choose **Support** in the sidebar, pick **Get support**, **Request a feature**, or **Emergency support**, and send one message. You can attach screenshots or short videos, and the support team replies in the same thread. Standard reply hours are 9:00–18:00 Japan time. Use **Emergency support** when a major incident is under way and you need SIGQ's help now; SIGQ members are notified immediately and help on a best-effort basis. Before you sign in, use the **Support** button at the bottom right of the screen.

See [Contact support](/help/support.md).

### Request an add-on yourself

Under **Settings → Project → Plugins**, Administrators see the add-ons they can request, such as on-call and the meeting bot, and choose **Request**. Once Incident Lake approves the request, the add-on is turned on for your project. You can withdraw a pending request, see the reason if a request is declined, and turn an add-on off yourself at any time.

See [Organization](/settings/organization.md#request-an-add-on).

### Smaller improvements

* Microsoft Teams now connects to a project by team rather than by your whole Microsoft organization, so different teams in the same organization can use different projects. A team can be connected to only one project. See [Integrations](/settings/integrations.md)
* The **Source** filter on the incident list and in incident search now includes **CSV import**
* Editing a knowledge entry has a single save button that saves all your changes
* The Public API now covers the CMDB, Problem Management, knowledge in bulk, SOP checklists, ITIL classification and closure, Change and release management, Emergency response, the Evidence Library, drills, improvement tasks, incident roles, severity, and tasks
* When an on-call call ends, the call's record at the phone provider is deleted. The transcript stays in Incident Lake's page history. See [On-call: data sent to third parties](/legal/on-call-third-parties.md)
  {% endupdate %}

{% update date="2026-10-27" tags="chat,incidents,settings" %}

## Decide the first move on the phone, fill your own report form, and clean up duplicate incidents

This update is for the first minutes of an incident, and for the reports and records that follow.

### Get phoned, briefed, and asked to decide

Under **Settings → Project → On-call**, Administrators set up rotations with a handoff time, overrides, and each person's phone number. When an incident starts, an escalation rule fires, or someone chooses **Page on-call by phone** on the incident, Incident Lake calls the person on call. The assistant briefs them in about 30 seconds, asks whether they can take it, and then answers their questions from the incident record, deployments, and similar past incidents, naming the source each time. The decision they confirm is read back and added to the incident's notes. Nothing is executed from a call. Rehearse with a past incident before you rely on it.

See [On-call](/settings/on-call.md).

### Hand Chat your report form and get it back filled in

Attach your own report template to a chat and ask for the report. The draft keeps the template's headings, numbering, wording, and table columns, and marks what the incident cannot fill as **Not yet determined**. When the template is a PDF form, the download is your original form with the values written into its cells and checkboxes.

See [Chat](/everyday-tools/chat.md#follow-your-own-template).

### Merge incidents that were recorded twice

Choose **Review duplicates** on the incident list. Incident Lake pairs incidents with near-identical content, or similar content or titles a few days apart, shows how confident it is, and suggests which one to keep. **Merge** keeps the other incident's notes and history and hides it from the list. **Not a duplicate** keeps the pair apart for good.

See [What is an incident?](/incidents/overview.md#review-duplicates).

### Smaller improvements

* Talking to the bot in Slack or Teams now requires your chat account to be linked to Incident Lake. If it is not, the bot sends you a private link to connect it. Creating incidents from a thread still works without linking. See [Use Incident Lake from Slack](/incidents/slack.md#ask-grounded-questions-in-slack-or-teams)
* **Account settings** is in the sidebar next to **Settings**, for every member
  {% endupdate %}

{% update date="2026-10-26" tags="chat,incidents,settings" %}

## Find the page in the PDF, see what a supplier outage stops, and keep the reporting clock

This update is for the moment a supplier is hit, a personal-data incident has to be reported, or the answer is buried in a long PDF.

### Search the original PDF, and let the assistant cite the page

**Evidence Library**, next to Knowledge, holds specifications, design documents, vendor manuals, and contracts. Upload a PDF, search it by an error code or a setting name, and open the page. During an incident, Chat reads the pages it needs and cites the document and the page. Scanned pages are transcribed in the background.

See [Evidence Library](/everyday-tools/evidence-library.md).

### See what stops if a supplier is hit

On a supplier in the Service catalog, choose **Breach impact**. Incident Lake lists the services that supplier backs, the services that depend on them, and the business operations that would stop, with the fallback and the shortest recovery target. **Declare an incident on these services** opens an incident with those services already attached.

See [Service catalog](/service-management/service-catalog.md#if-a-supplier-is-breached).

### Keep personal-data reporting deadlines in view

On the **ITIL classification & closure** tab, choose **Start deadline tracking** when personal data may have leaked. Record when the organization became aware and which regimes apply. Incident Lake shows each filing clock, reminds the Incident Commander the day before a deadline and again when it is overdue, and lets you mark a report as filed. Confirm the judgement with your legal team.

See [Work an incident](/incidents/work-an-incident.md#data-breach-reporting-deadlines).

### Work a large CMDB, and see which rules to review

Switch the CMDB to **List View** to search, filter, edit in bulk, and export CSV. **Manage locations** records data centers and offices by country, and NetBox sites become locations. **Regulations** then suggests which data-protection and cybersecurity rules to review, from each item's country and tags. On an incident, **Regulatory reporting guide** lists duties that may apply to the affected items. This is general information, not legal advice.

See [CMDB](/management/cmdb.md#list-view).

### Tell the AI the facts it must not forget

Under **Settings → Project → Organization context**, Administrators register the profile, rules, internal terms, owners, escalation paths, and decisions the AI should treat as given. Entries marked **Always include** go into every answer. Others are used when the question mentions their title or a keyword.

See [Organization](/settings/organization.md#organization-context).

### Let Chat update Incident Lake, after you confirm

In web chat, and in Slack or Teams when your chat account is linked, the assistant can look up incidents, knowledge, and the CMDB, and propose a change. Nothing is written or deleted until you choose **Make change** or **Delete**. Only the person who asked can confirm, and the proposal expires after 60 minutes.

See [Chat](/everyday-tools/chat.md#change-records-after-you-confirm).

### Send one notice to a list of people

**Management → Broadcast email** sends one message to addresses in a CSV, or reuses a past list. Each person receives a separate email. You can require another member to approve before it sends.

See [Broadcast email](/management/broadcast-email.md).

### Smaller improvements

* A note can read the words in an attached image. **Read text in images into the note** uses AI credits
* Mentioning the bot with no other text shows a menu of the commands that fit that thread
* The Incident Response Agent closes a question when the thread or the incident page already has the answer, and nudges at most twice. Drafts of the summary, timeline, and tasks still wait for a person to confirm
* Chat and report drafts leave out knowledge that only loosely matches. Selecting a tag still includes every entry with that tag
* Administrators can hide more sidebar pages and incident tabs under **Settings → Project → Features**. Turning one off hides it; the data stays
* If an AI tool cannot reach Incident Lake, copy the **MCP server URL** again from **Account settings → AI tools (MCP)**. Connections that already signed in keep working
  {% endupdate %}

{% update date="2026-10-20" tags="chat,incidents,settings,templates" %}

## Trace alerts to the exact device, turn alert emails into incidents, and start reports from ready-made prompts

This update brings your data-center hardware and alert emails into the response, and gives Chat more to work with.

### See which device and port an alert is about

Connect NetBox, and your devices, ports, cables, and IP addresses appear in the CMDB. When an alert names a known host, IP address, or port, the incident shows the device, the port, and what is on the other end of the cable under **Affected hardware**. The Incident Response Agent can look up the same hardware while it investigates.

See [Integrations](/settings/integrations.md#netbox) and [CMDB](/management/cmdb.md#hardware-from-netbox).

### Turn monitoring emails into incidents

If your monitoring tools send alerts by email, the Outlook service mailbox can now pass them on as alerts. Choose which senders and subjects count, and Incident Lake posts each alert to your Slack or Teams alert channel for someone to create or dismiss. Once an incident is created, the email and every later reply in that thread are added to its notes.

See [Integrations](/settings/integrations.md#turn-monitoring-emails-into-alerts).

### Start a report from a SIGQ template

In Chat, choose **Write from a template** to insert a ready-made prompt for customer notices, executive summaries, personal data breach reports, regulator reports, and more, in Japanese or English. Edit it, then send. The same templates appear when you generate a report draft on an incident, and you can copy one to your saved prompts to make it your own.

Administrators can set the project's industry and business type so that only the templates that fit your organization appear.

See [Chat](/everyday-tools/chat.md#start-from-a-template) and [Organization](/settings/organization.md#industry-and-business-type).

### Ask Chat about a web page

Paste a link to a public page into Chat, in the web app or with the bot in Slack or Teams, and the assistant reads the page and answers from it. Links to known malware or phishing sites are not opened.

See [Chat](/everyday-tools/chat.md#ask-about-a-web-page).

### Keep some knowledge out of automatic answers

Turn off **Include in automatic chat / AI search** on a knowledge entry, and chat and AI use it only when one of its tags is selected.

See [Knowledge](/everyday-tools/knowledge.md#use-an-entry-only-when-its-tag-is-selected).

### Check every connection before you rely on it

Every integration that uses a URL, key, or token now has **Test connection**, which tells you why a connection failed. You can also disconnect such a tool by clearing its token and saving.

See [Integrations](/settings/integrations.md#check-a-connection).

### Smaller improvements

* In drill scenarios, each activity to bring back first can be linked to several configuration items
* Major incident notices wait while an incident is stalled, and go out when it is back to ongoing
* Improvement Tasks are split into pages of 20
* Delete and remove confirmations now open inside Incident Lake instead of as browser pop-ups
  {% endupdate %}

{% update date="2026-10-16" tags="incidents,settings" %}

## See which change caused an incident, and keep response-time promises

This update connects incidents to the changes that went live before them, and helps you keep the response times you promised.

### Find the change behind an incident

The new **Changes** page brings in pull requests, releases, and deployments from GitHub. You can see what each release shipped and what each deployment took live. Choose up to 10 repositories and filter by label.

On an incident, **Suspects** lists the changes that went live shortly before it, with changes to the same service first. Mark the cause in one click. The change failure rate and other change KPIs then show up in analytics.

See [Change and release management](/service-management/changes.md).

### Keep agreements and supplier contacts at hand

The new **Service catalog** shows your published services, their owners, support hours, and agreements. Record SLAs, OLAs, and contracts with suppliers, with targets, end dates, and a link to the contract document. Incident Lake reminds the owner before an agreement ends.

During an incident, the agreements and supplier contacts for the affected services appear on the incident page.

See [Service catalog](/service-management/service-catalog.md).

### Keep response deadlines, escalate on time, and handle major incidents the same way every time

Administrators can now set response deadlines per priority, counted in business hours if you like. They can also escalate automatically when nobody responds in time, and declare a major incident automatically, with an SOP applied and the commanders notified. Missed deadlines notify people in the app even when the incident has no chat channel.

SLO targets on a service, such as time to restore or availability, are now judged automatically from incident times.

See [Workflow](/settings/workflow.md#deadlines-escalation-and-major-incidents) and [CMDB](/management/cmdb.md#service-levels).

### Find features faster in the sidebar

The sidebar is now grouped into **Analytics**, **Service management**, and **Readiness & reporting**, so related pages sit together.

See [Find your way around](/getting-started/navigation.md).

### Connect GitHub with the right token the first time

The GitHub dialog now lists every permission the token needs and what it is used for. After you enter the token, pick the repository from a list instead of typing its name.

See [Integrations](/settings/integrations.md#code-and-changes).

### Spot response times entered in the wrong order

When response times are out of order, for example detection earlier than occurrence, the incident page marks them in red so you can fix them before resolving.

See [Work an incident](/incidents/work-an-incident.md#response-times).
{% endupdate %}

{% update date="2026-10-15" tags="chat,incidents,settings" %}

## Get to the root cause, and bring meetings, email, and ServiceNow into the response

This update helps teams stop the same incident from coming back, and brings more of the response into one record.

### Track root causes with Problem Management

**Risk Map** is now **Problem Management**. Register something that keeps happening as a problem, record its root cause, workaround, and permanent fix, and link all the incidents it caused. **Candidates** suggests groups of similar incidents that are not linked to a problem yet.

When a problem becomes a known error, the AI drafts a known-error knowledge item, so the next responder finds the workaround right away. Corrective actions become improvement tasks.

See [Problem Management](/service-management/problems.md) and [Knowledge](/everyday-tools/knowledge.md#types-and-known-errors).

### Set priority from impact and urgency, and close incidents with a record

The new **ITIL classification & closure** tab on the incident sets the priority from impact and urgency, flags major incidents, and closes the incident with a resolution code and root cause summary. Administrators define the priority matrix and subcategories under **Settings → Workflow**.

The new **ITIL KPIs** dashboard shows MTTA, MTTR, SLA compliance, reopen rate, and how many incidents are linked to a problem.

See [Work an incident](/incidents/work-an-incident.md#itil-classification-and-closure) and [Incident Analytics](/everyday-tools/analytics.md#itil-kpis).

### Let Incident Lake take notes in the incident call

The meeting bot joins your Zoom, Google Meet, Teams, or Webex call, transcribes it, and keeps a summary note on the incident up to date. Send it from the incident page, or answer **Send Incident Lake** when someone pastes a meeting link in the incident thread. The meeting bot is an add-on.

See [Meeting bot](/incidents/meeting-bot.md).

### Keep the incident thread for your team

The Incident Response Agent now asks its questions in a separate thread in the same channel, in both Slack and Teams. The incident thread keeps your team's conversation, with a link to the agent's thread. In Teams, reminders now come as cards with a **Stop the check-in** button, as in Slack.

See [Incident Response Agent](/incidents/agent.md#the-agent-works-in-its-own-thread).

### Connect ServiceNow

Attach ServiceNow incidents, problems, and changes to an incident, and link incident tasks to ServiceNow records. Their title, assignee, due date, and state stay in sync.

See [Integrations](/settings/integrations.md#servicenow).

### Let the agent search your alert mailbox

Connect a dedicated Outlook service mailbox, and the Incident Response Agent can search alert and vendor emails sent there while it investigates.

See [Integrations](/settings/integrations.md#outlook-service-mailbox).
{% endupdate %}

{% update date="2026-10-13" tags="chat,incidents,reports,settings,templates" %}

## Customize reports, dashboards, and task follow-up with less manual work

This update helps responders and administrators keep daily work in one flow: clearer chat prompts, easier account control, more flexible reporting, and tighter task follow-up.

### Build and reuse your own regulatory report templates

You can now upload your own regulatory report templates, upload filled examples to guide draft quality, edit template sections and fields, rename templates, and delete templates or examples when they are no longer needed.

This makes report drafting closer to your organization’s required format from the first draft.

See [Report templates](/everyday-tools/report-templates.md).

### Tailor analytics views for each audience

Incident Analytics now supports customizable dashboards, so each team can keep the charts and filters they review most often.

This makes weekly reviews faster and keeps executive, operations, and response views separate without rebuilding charts each time.

See [Incident Analytics](/everyday-tools/analytics.md).

### Keep incident tasks in sync with ticket tools

Incident tasks now sync more smoothly with connected ticket tools, and pasted ticket links are recognized and linked automatically.

This reduces copy-paste work and helps everyone track progress from either side.

See [Work an incident](/incidents/work-an-incident.md) and [Integrations](/settings/integrations.md).

### Get cleaner incident prompts in fully monitored channels

In channels monitored in full-channel mode, Incident Lake now asks “Shall we open an incident?” less often when there is no real incident signal.

This lowers alert fatigue while keeping incident detection active.

See [Use Incident Lake from Slack](/incidents/slack.md).

### Run BCP drills from reusable masters

CMDB now supports BCP drill exercises that start from generic masters, so teams can standardize drill format and still adapt to each service.

See [CMDB](/management/cmdb.md).

### Turn key response support on or off per project

Administrators can control core support steps by project, including severity handling, incident commander guidance, affected services suggestions, postmortem support, and task support.

See [Workflow](/settings/workflow.md) and [Incident Response Agent](/incidents/agent.md).

### Keep account and AI-tool project selection predictable

Account settings now stays the one place for sign-in, language, and AI tool project selection. Existing connected clients each require a one-time project confirmation when the project is first selected or changed.

This makes cross-device setup clearer and reduces confusion when tools switch projects.

See [Account settings](/settings/profile.md).
{% endupdate %}

{% update date="2026-10-07" tags="chat,incidents,settings" %}

## Get answers faster in chat and manage your account in one place

This update removes extra clicks in day-to-day response and makes account setup clearer.

### Get immediate answers for everyday chat questions

In web chat, Slack, and Teams, questions about live incident state, instructions, acknowledgements, general knowledge, or date and time are now answered immediately.

When you ask for a procedure, a fix, a workaround, or a similar past case, Incident Lake can still suggest knowledge and past incidents first so you can choose context when it helps.

See [Chat](/everyday-tools/chat.md) and [Use Incident Lake from Slack](/incidents/slack.md).

### Manage sign-in, language, and AI tool access from one place

You can now open **Account settings** from your user menu and manage email/sign-in, language, and connected AI tools together.

You can also choose which project connected AI tools can use. Existing AI tool users need a one-time project confirmation in each connected client.

See [Account settings](/settings/profile.md).

### Connect AI tools by signing in — no API token or local install

Claude, Cursor, VS Code, and Claude Code can now connect to Incident Lake through a hosted MCP server. Copy the URL from **Account settings → AI tools (MCP)**, add it to your tool, and sign in. The tool acts with your account and role, and SIGQ keeps the server up to date for you.

Running the MCP server on your own computer with an API token is deprecated. It keeps working for now, but please move to the hosted connection.

See [AI tools (MCP)](/settings/ai-tools.md).

### Keep progress updates quieter during active response

When responders post progress reports, the Incident Response Agent no longer sends automatic next-step replies. Teams can report status without extra interruption.

See [Work an incident](/incidents/work-an-incident.md) and [Use Incident Lake from Slack](/incidents/slack.md).

### Bring Rollbar alerts into response with more setup options

Rollbar can be used as an alert signal with webhook-based setup, giving teams another path to bring alerts into Incident Lake.

See [Integrations](/settings/integrations.md).
{% endupdate %}

{% update date="2026-10-05" tags="incidents,settings" %}

## Keep response support in your control and manage projects at organization level

This update helps responders stay in flow during active incidents and gives admins clearer control across multiple projects.

### Adjust agent support without losing momentum

From Slack or from the incident page, you can now pause, narrow, stop, and later resume the Incident Response Agent’s check-ins. You can also turn off Slack reminders for unanswered agent questions.

When you stop support, Incident Lake now asks how far to back off, so you can reduce noise without ending help more than intended.

See [Use Incident Lake from Slack](/incidents/slack.md) and [Work an incident](/incidents/work-an-incident.md).

### Choose the right incident destination from chat

When Incident Lake detects a possible incident in chat, you can choose where to handle it and link the thread to a recent incident from a dropdown. This keeps work in the right record and cuts duplicate incident creation.

See [Use Incident Lake from Slack](/incidents/slack.md).

### Manage projects and charges more easily across your organization

If you are an Organization admin, you can open and manage every project in your organization without being added one by one. Organization admins can also add, remove, and re-role organization members.

Organization admins and Billing viewers can now see monthly charges by project and in total, so cost reviews are faster.

See [Organization](/settings/organization.md), [Members](/settings/members.md), and [Roles and permissions](/getting-started/roles.md).

### Use Sentry and Rollbar signals more directly in response

Sentry and Rollbar can now be used more directly during triage, including finding Sentry items from incident-related resources and using Rollbar as an additional alert signal.

See [Integrations](/settings/integrations.md).
{% endupdate %}

{% update date="2026-10-02" tags="chat,incidents,reports,settings,templates" %}

## Move from chat and response to finished records with less rework

This update makes day-to-day response smoother across sign-in, chat, incident work, and settings.

### Keep access simple during sign-in changes

Existing members can keep signing in with the same email and password or Google account on the current sign-in form. If a password is rejected, they can reset it right away from the sign-in screen.

See [Sign in](/getting-started/sign-in.md).

### Draft better documents faster, then export where you need them

Report generation now starts with prompt selection, including shared prompt templates. Chat files are generated from the incident’s current notes, tasks, and messages, and you can update or re-export a file in the same chat. If a long file is cut off, you still receive it with an **incomplete** notice.

Incident and chat documents stay in the in-app editor for review and export as PDF or Word.

See [Chat](/everyday-tools/chat.md) and [Work an incident](/incidents/work-an-incident.md).

### Ask in Slack or Teams with clearer context control

In Slack and Teams, you can keep asking free-text questions and now choose which suggested knowledge and past incidents should be used before the answer. If you request a file there, Incident Lake sends you to the in-app editor to create and download it.

When you dismiss an incident prompt, you can add an optional reason to improve future prompts for your organization.

See [Use Incident Lake from Slack](/incidents/slack.md).

### Manage response setup with clearer controls

You can now set AI guidelines for permission groups so responses stay aligned by team. On incident resolution, if important record fields are missing, Incident Lake opens a completion step before applying resolve.

ILC consumption now reflects the model used and the amount of text the AI reads and writes, shown consistently across usage and pricing screens. During a pay-as-you-go proof of concept, each ILC has one flat price.

See [Permission groups](/settings/permission-groups.md), [Organization](/settings/organization.md), and [Workflow](/settings/workflow.md).

### See what each plan includes

The feature list now has a pricing overview and compares Free, Team, and the annual plan side by side, with Free and Team eligibility, how credits and limits work, and the annual plan tiers. It also explains how a proof of concept helps you size an annual allowance.

See [Feature list](/getting-started/features.md).
{% endupdate %}

{% update date="2026-10-01" tags="incidents" %}

## Keep Slack and Teams updates in your incident record automatically

When your incident is linked to a Slack or Teams thread, new thread updates are now added to **Notes** within about 2 minutes and attributed to **Slack / Teams**. You get a durable incident record without copying chat updates by hand.

The **Communication** tab now stays focused on current work. Raw Slack or Teams messages that were already captured as Notes roll off that tab after about 60 minutes, while the Note remains available for incident history.

See [Work an incident](/incidents/work-an-incident.md).
{% endupdate %}

{% update date="2026-09-23" tags="settings" %}

## Give teams the right access without changing everyone’s role

You can now create **permission groups** with feature-level access and assign them to members. This makes it easier to give each team the access they need while keeping role setup simple.

Use roles for broad responsibility, then use permission groups for specific feature access. This helps you onboard people faster and reduce manual role changes when responsibilities vary by team.

See [Permission groups](/settings/permission-groups.md), [Members](/settings/members.md), and [Roles and permissions](/getting-started/roles.md).
{% endupdate %}

{% update date="2026-09-22" tags="chat,incidents,reports,settings,templates" %}

## Move from triage to action faster, in one place

You can now carry more of the response from first question to finished record without repeating work.

### Start from chat, then open the incident with one click

When you gather facts in Chat first, you can create an incident directly from that conversation and carry the context into the new record. Chat can also suggest improvement tasks and help draft regulatory reports for your review.

See [Create an incident](/incidents/create.md), [Chat](/everyday-tools/chat.md), and [Work an incident](/incidents/work-an-incident.md).

### Bring existing playbooks in faster

Knowledge now supports CSV import, so you can move existing guidance into Incident Lake in bulk and then review entries in place.

See [Knowledge](/everyday-tools/knowledge.md).

### Use Slack and Teams questions like in Chat

In Slack or Teams, you can mention the bot with a normal question and get grounded answers with sources in the same language you used. If you ask for a file in chat, Incident Lake now points you to the in-app editor where files are created and downloaded.

See [Use Incident Lake from Slack](/incidents/slack.md) and [Chat](/everyday-tools/chat.md).

### Control automations from one tab

Automation settings are now centralized with one switch per feature. You can turn on Incident Response Agent as the recommended path, keep feature-level control when the agent is off, and see clear reasons when a switch cannot be turned on.

See [Workflow](/settings/workflow.md).
{% endupdate %}

{% update date="2026-09-21" tags="chat,incidents,reports,settings,templates" %}

## Work across related incidents and take a finished document with you

You can now keep more of the response in one place, in the words your organization already uses, and leave with a file you can share.

### Talk about several incidents at once

A single Chat can follow up to **five** related incidents. The assistant sees all of them, so you can ask “what do these have in common?” instead of starting a new conversation for each record. When you save a note or a draft, you choose which incident should receive it.

See [Chat](/everyday-tools/chat.md).

### Leave with a document the team can actually send

Ask Chat for a briefing or report, review it in the document editor (visual blocks or Markdown), then download **PDF** or **Word**. Incident reports work the same way: start a draft, publish it when it is ready, and download the current version. You no longer send those files straight to Slack, Teams, or Notion from the incident page — download them and share them yourself.

See [Chat](/everyday-tools/chat.md) and [Work an incident](/incidents/work-an-incident.md).

### Keep working files on the note, not in a side channel

On an incident **Notes** tab you can attach images and files (PDF, Word, Excel, CSV, text, and similar) with the paperclip, drag and drop, or paste. Images show in the note; other files become a download that only signed-in people can open. That material stays with the incident instead of living only in someone’s inbox.

See [Work an incident](/incidents/work-an-incident.md).

### Use the words your industry already says

Administrators can rename everyday labels — incident, postmortem, severity, stakeholder, knowledge, CMDB, and others — so the product matches manufacturing, healthcare, finance, retail, or the public sector. Everyone in the organization sees the new words. Slack, email, and stored records stay as they were.

See [Organization](/settings/organization.md).

### Check a My Number filing without mixing it up with APPI

**Report Templates** now includes **Specified personal information breach report (Number Act Art. 29-4)**. It is a checklist for a **separate** track from APPI Art. 26 — different criteria, a different PPC form, and different deadlines. Incident Lake does not decide whether it applies; your compliance team and the official guidance do.

See [Report templates](/everyday-tools/report-templates.md).
{% endupdate %}
{% endupdates %}