Repository: openshift/openshift-docs
Pull request #90113: OBSDOCS-1751 incident detection ui plugin
Author: login: gabriel-rh
Labels: name: peer-review-done
description: Signifies that the peer review team has reviewed this PR
name: lgtm
description: Indicates that a PR is ready to be merged.
name: size/L
description: Denotes a PR that changes 100-499 lines, ignoring generated files.
name: observability
Created: 2025-03-11T17:40:12Z | Merged: 2025-03-31T09:03:53Z

Version(s):
4.12+

Issue:
[OBSDOCS-1751](https://issues.redhat.com//browse/OBSDOCS-1751)

Link to docs preview:

https://90113--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.html

https://90113--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.html




QE review:
- [ ] QE has approved this change.
<!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->

Additional information:
<!--- Optional: Include additional context or expand the description here.--->

<!--- After you open your PR, ask for review from the OpenShift docs team:
  For community authors: Tag @openshift/team-documentation in a GitHub comment.--->



Diff:
diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml
index 64fdade2f6c3..82c2c782291e 100644
--- a/_topic_maps/_topic_map.yml
+++ b/_topic_maps/_topic_map.yml
@@ -2911,6 +2911,8 @@ Topics:
     Topics:
     - Name: Observability UI plugins overview
       File: observability-ui-plugins-overview
+    - Name: Monitoring UI plugin
+      File: monitoring-ui-plugin
     - Name: Logging UI plugin
       File: logging-ui-plugin
     - Name: Distributed tracing UI plugin
diff --git a/images/coo-incident-alerts-components-expanded.png b/images/coo-incident-alerts-components-expanded.png
new file mode 100644
index 000000000000..03b766dd3740
Binary files /dev/null and b/images/coo-incident-alerts-components-expanded.png differ
diff --git a/images/coo-incident-alerts-components.png b/images/coo-incident-alerts-components.png
new file mode 100644
index 000000000000..5fd9344f7015
Binary files /dev/null and b/images/coo-incident-alerts-components.png differ
diff --git a/images/coo-incident-alerts-timeline.png b/images/coo-incident-alerts-timeline.png
new file mode 100644
index 000000000000..843640434977
Binary files /dev/null and b/images/coo-incident-alerts-timeline.png differ
diff --git a/images/coo-incidents-timeline-daily.png b/images/coo-incidents-timeline-daily.png
new file mode 100644
index 000000000000..dddaf5ac1097
Binary files /dev/null and b/images/coo-incidents-timeline-daily.png differ
diff --git a/images/coo-incidents-timeline-weekly.png b/images/coo-incidents-timeline-weekly.png
new file mode 100644
index 000000000000..9674f48936cb
Binary files /dev/null and b/images/coo-incidents-timeline-weekly.png differ
diff --git a/images/coo-incidents-timeline.png b/images/coo-incidents-timeline.png
new file mode 100644
index 000000000000..0b9d415533cf
Binary files /dev/null and b/images/coo-incidents-timeline.png differ
diff --git a/modules/coo-distributed-tracing-ui-plugin-install.adoc b/modules/coo-distributed-tracing-ui-plugin-install.adoc
index 1009d113ed46..1a7cfb613785 100644
--- a/modules/coo-distributed-tracing-ui-plugin-install.adoc
+++ b/modules/coo-distributed-tracing-ui-plugin-install.adoc
@@ -3,7 +3,7 @@
 // * observability/cluster_observability_operator/ui_plugins/distributed-tracing-ui-plugin.adoc
 
 :_mod-docs-content-type: PROCEDURE
-[id="coo-distributed-tracing-ui-plugin-install-_{context}"]
+[id="coo-distributed-tracing-ui-plugin-install_{context}"]
 = Installing the {coo-full} distributed tracing UI plugin
 
 
diff --git a/modules/coo-incident-detection-overview.adoc b/modules/coo-incident-detection-overview.adoc
new file mode 100644
index 000000000000..17a65d240a13
--- /dev/null
+++ b/modules/coo-incident-detection-overview.adoc
@@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="coo-incident-detection-overview_{context}"]
+= {coo-full} incident detection overview
+
+Clusters can generate significant volumes of monitoring data, making it hard for you to distinguish critical signals from noise.
+Single incidents can trigger a cascade of alerts, and this results in extended time to detect and resolve issues.
+
+The {coo-full} incident detection feature groups related alerts into *incidents*. These incidents are then visualized as timelines that are color-coded by severity.
+Alerts are mapped to specific components, grouped by severity, helping you to identify root causes by focusing on high impact components first.
+You can then drill down from the incident timelines to individual alerts to determine how to fix the underlying issue.
+
+{coo-full} incident detection transforms the alert storm into clear steps for faster understanding and resolution of the incidents that occur on your clusters.
diff --git a/modules/coo-incident-detection-using.adoc b/modules/coo-incident-detection-using.adoc
new file mode 100644
index 000000000000..eaa66fe91944
--- /dev/null
+++ b/modules/coo-incident-detection-using.adoc
@@ -0,0 +1,59 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[Weekly incidents timeline]
++
+[NOTE]
+====
+It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts that have been resolved before feature enablement are not included.
+====
+
+. Zoom in to a 1-day view by clicking on the drop-down to specify the duration.
++
+image::coo-incidents-timeline-daily.png[Daily incidents timeline]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[Incidents alerts timeline]
+
+. In the list of alerts that follows, alerts are mapped to specific components, which are grouped by severity.
++
+image::coo-incident-alerts-components.png[Incidents alerts components]
+
+. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
++
+image::coo-incident-alerts-components-expanded.png[Incidents expanded components]
+
+. Click the link for a firing alert, to see detailed information about that alert.
+
+
+
+[NOTE]
+====
+**Known issues**
+
+* Depending on the order of the timeline bars, the tooltip might overlap and hide the underlying bar. You can still click the bar and select the incident or alert.
+
+* The Silence Alert button in the **Incidents** -> **Component** section does not pre-populate the fields and is not usable. As a workaround, you can use the same menu and the Silence Alert button in the **Alerting** section instead.
+====
\ No newline at end of file
diff --git a/modules/coo-monitoring-ui-plugin-install.adoc b/modules/coo-monitoring-ui-plugin-install.adoc
new file mode 100644
index 000000000000..8ab8cd1d71bc
--- /dev/null
+++ b/modules/coo-monitoring-ui-plugin-install.adoc
@@ -0,0 +1,42 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-monitoring-ui-plugin-install_{context}"]
+= Installing the {coo-full} monitoring UI plugin
+
+The monitoring UI plugin adds monitoring related UI features to the OpenShift web console, for the Advance Cluster Management (ACM) perspective and for incident detection.
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}
+
+.Procedure
+
+. In the {product-title} web console, click *Operators* -> *Installed Operators* and select {coo-full}
+. Choose the *UI Plugin* tab (at the far right of the tab list) and press *Create UIPlugin*
+. Select *YAML view*, enter the following content, and then press *Create*:
++
+[source,yaml]
+----
+apiVersion: observability.openshift.io/v1alpha1
+kind: UIPlugin
+metadata:
+  name: monitoring
+spec:
+  type: Monitoring
+  monitoring:
+    acm: # <1>
+      enabled: true
+      alertmanager:
+        url: 'https://alertmanager.open-cluster-management-observability.svc:9095'
+      thanosQuerier:
+        url: 'https://rbac-query-proxy.open-cluster-management-observability.svc:8443'  
+    incidents: # <2>
+      enabled: true  
+----
+<1> Enable {rh-rhacm} features. You must configure the Alertmanager and ThanosQuerier Service endpoints.
+<2> Enable incident detection features. 
\ No newline at end of file
diff --git a/observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc b/observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc
new file mode 100644
index 000000000000..414affa4726f
--- /dev/null
+++ b/observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc
@@ -0,0 +1,24 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="monitoring-ui-plugin"]
+= Monitoring UI plugin
+include::_attributes/common-attributes.adoc[]
+:context: monitoring-ui-plugin
+
+toc::[]
+
+:FeatureName: The {coo-full} monitoring UI plugin
+include::snippets/technology-preview.adoc[leveloffset=+2]
+
+The monitoring UI plugin adds monitoring features to the Administrator perspective of the OpenShift web console.
+
+* **{rh-rhacm}:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing {rh-rhacm} with the same alerting capabilities as {product-title}. You can configure the plugin to fetch alerts from the {rh-rhacm} Alertmanager backend. This enables seamless integration and user experience by aligning {rh-rhacm} and {product-title} monitoring workflows.
+
+* **Incident detection:** The incident detection feature groups related alerts into incidents, to help you identify the root causes of alert bursts, instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and you can drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, grouped by severity. This helps you focus on the most critical areas first.
++
+The incident detection feature is available in the Administrator perspective of the OpenShift web console at **Observe** → **Incidents**. 
+
+include::modules/coo-monitoring-ui-plugin-install.adoc[leveloffset=+1]
+
+include::modules/coo-incident-detection-overview.adoc[leveloffset=+1]
+
+include::modules/coo-incident-detection-using.adoc[leveloffset=+1]
\ No newline at end of file
diff --git a/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc b/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
index dadd25a44763..d69e4216464d 100644
--- a/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
+++ b/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
@@ -9,7 +9,16 @@ toc::[]
 You can use the {coo-first} to install and manage UI plugins to enhance the observability capabilities of the {product-title} web console.
 The plugins extend the default functionality, providing new UI features for troubleshooting, distributed tracing, and cluster logging.
 
+[id="monitoring_{context}"]
+== Monitoring
 
+The monitoring UI plugin adds monitoring related UI features to the OpenShift web console, for the Advance Cluster Management (ACM) perspective and for incident detection.
+
+* **ACM:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing ACM with the same monitoring capabilities as {product-title}.
+
+* **Incident Detection:** The incident detection feature groups alerts into incidents to help you identify the root causes of alert bursts instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and you can drill down into the individual alerts within an incident. The system also categorizes alerts by affected component to help you focus on the most critical areas first.
+
+For more information, see the xref:../../../observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc#monitoring-ui-plugin[monitoring UI plugin] page.
 
 [id="cluster-logging_{context}"]
 == Cluster logging
@@ -19,7 +28,6 @@ You can specify filters, queries, time ranges and refresh rates. The results dis
 
 For more information, see the xref:../../../observability/cluster_observability_operator/ui_plugins/logging-ui-plugin.adoc#logging-ui-plugin[logging UI plugin] page.
 
-
 [id="troubleshooting_{context}"]
 == Troubleshooting
 
@@ -46,7 +54,6 @@ You can select a supported `TempoStack` or `TempoMonolithic` multi-tenant instan
 
 For more information, see the xref:../../../observability/cluster_observability_operator/ui_plugins/distributed-tracing-ui-plugin.adoc#distributed-tracing-ui-plugin[distributed tracing UI plugin] page.
 
-
 ////
 [id="dashboards_{context}"]
 == Dashboards
@@ -57,4 +64,4 @@ This results in a unified observability experience across different data sources
 
 For more information, see the xref :../../../observability/cluster_observability_operator/ui_plugins/dashboard-ui-plugin.adoc#dashboard-ui-plugin[dashboard UI plugin] page.
 
-////
\ No newline at end of file
+////


Reviews:
user: login: falox
state: CHANGES_REQUESTED
author_association: NONE
submitted_at: 2025-03-17T12:41:58Z
user: login: falox
state: CHANGES_REQUESTED
author_association: NONE
submitted_at: 2025-03-18T08:26:40Z
user: login: ocpdocs-vale-bot
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-18T12:29:39Z
user: login: ocpdocs-vale-bot
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-18T15:54:15Z
user: login: tmalove
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T19:26:13Z
user: login: lihongyan1
state: COMMENTED
author_association: NONE
submitted_at: 2025-03-21T06:43:46Z

Review comments:
diff_hunk: @@ -9,7 +9,16 @@ toc::[]
 You can use the {coo-first} to install and manage UI plugins to enhance the observability capabilities of the {product-title} web console.
 The plugins extend the default functionality, providing new UI features for troubleshooting, distributed tracing, and cluster logging.
 
+[id="monitoring_{context}"]
+== Monitoring
 
+The monitoring UI plugin adds monitoring related UI features to the OpenShift web console, for the Advance Cluster Management (ACM) perspective and for incident detection.
+
+* **ACM:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing ACM with the same monitoring capabilities as {product-title}.
+
+* **Incident Detection:** The incident detection feature groups alerts that occur around the same time into incidents to help you identify the root causes of alert bursts instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and allows you to drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, ranking them by importance. This helps you focus on the most critical areas first.
path: observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
user: login: falox
body: Let's not stick to the implementation (that will change), better replace "that occur around the same time" with a generic "The incident detection feature groups related alerts into incidents"

Also please remove ", ranking them by importance", since it's not implemented yet in 1.1
created_at: 2025-03-17T12:20:13Z
author_association: NONE
diff_hunk: @@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="coo-incident-detection-overview_{context}"]
+= {coo-full} incident detection overview
+
+Clusters can generate significant volumes of monitoring data, making it hard for you to distinguish critical signals from noise.
+Single incidents can trigger a cascade of alerts, and this results in extended time to detect and resolve issues.
+
+The {coo-full} incident detection feature groups alerts, that are correlated by time, into *incidents*. These incidents are then visualized as timelines that are color-coded by severity.
path: modules/coo-incident-detection-overview.adoc
user: login: falox
body: ```suggestion
The {coo-full} incident detection feature groups related alerts into *incidents*. These incidents are then visualized as timelines that are color-coded by severity.
```
created_at: 2025-03-17T12:24:28Z
author_association: NONE
diff_hunk: @@ -0,0 +1,37 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident.
++
+image::coo-incidents-timeline.png[]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[]
+
+. In the list of alerts, alerts are mapped to specific components, which are ranked by criticality.
++
+image::coo-incident-alerts-components.png[]
+
+. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
++
+image::coo-incident-alerts-components-expanded.png[]
+
+. Click on an alert link to see detailed information about that alert.
path: modules/coo-incident-detection-using.adoc
user: login: falox
body: Please note that this is only available for firing alerts at this time.
created_at: 2025-03-17T12:27:24Z
author_association: NONE
diff_hunk: @@ -0,0 +1,37 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident.
path: modules/coo-incident-detection-using.adoc
user: login: falox
body: Add a note that once the feature is enabled, it will take at least 10 minutes to process the correlations before you see the timeline.
created_at: 2025-03-17T12:30:01Z
author_association: NONE
diff_hunk: @@ -0,0 +1,37 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident.
path: modules/coo-incident-detection-using.adoc
user: login: falox
body: In addition, the analysis and grouping into incidents is performed only for alerts that are firing after feature enablement. Alerts resolved prior to feature enablement are not included.
created_at: 2025-03-17T12:36:04Z
author_association: NONE
path: images/coo-incident-alerts-components-expanded.png
user: login: falox
body: I will provide in DM the updated screenshots
created_at: 2025-03-17T12:41:52Z
author_association: NONE
diff_hunk: @@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="coo-incident-detection-overview_{context}"]
+= {coo-full} incident detection overview
+
+Clusters can generate significant volumes of monitoring data, making it hard for you to distinguish critical signals from noise.
+Single incidents can trigger a cascade of alerts, and this results in extended time to detect and resolve issues.
+
+The {coo-full} incident detection feature groups alerts, that are correlated by time, into *incidents*. These incidents are then visualized as timelines that are color-coded by severity.
+Alerts are mapped to specific components, ranked by criticality, helping you to identify root causes by focusing on high impact components first.
path: modules/coo-incident-detection-overview.adoc
user: login: falox
body: ```suggestion
Alerts are mapped to specific components, grouped by severity, helping you to identify root causes by focusing on high impact components first.
```
created_at: 2025-03-18T08:23:50Z
author_association: NONE
diff_hunk: @@ -0,0 +1,37 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident.
++
+image::coo-incidents-timeline.png[]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[]
+
+. In the list of alerts, alerts are mapped to specific components, which are ranked by criticality.
path: modules/coo-incident-detection-using.adoc
user: login: falox
body: ```suggestion
. In the list of alerts, alerts are mapped to specific components, which are grouped by severity.
```
created_at: 2025-03-18T08:24:16Z
author_association: NONE
diff_hunk: @@ -0,0 +1,24 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="monitoring-ui-plugin"]
+= Monitoring UI plugin
+include::_attributes/common-attributes.adoc[]
+:context: monitoring-ui-plugin
+
+toc::[]
+
+:FeatureName: The {coo-full} monitoring UI plugin
+include::snippets/technology-preview.adoc[leveloffset=+2]
+
+The monitoring UI plugin adds monitoring features to the Administrator perspective of the OpenShift web console.
+
+* **{rh-rhacm}:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing {rh-rhacm} with the same monitoring capabilities as {product-title}. You can configure the plugin to fetch alerts from the {rh-rhacm} Alertmanager backend. This enables seamless integration and user experience by aligning {rh-rhacm} and {product-title} monitoring workflows.
+
+* **Incident detection:** Incident detection groups alerts that occur around the same time into incidents, to help you identify the root causes of alert bursts instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and allows you to drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, ranking them by importance. This helps you focus on the most critical areas first.
path: observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc
user: login: falox
body: Keep this paragraph consistent with the one in the overview https://github.com/openshift/openshift-docs/pull/90113/files#diff-9d929d1ec2c430283b648bcd1fffdc9493ff75acc97cb722b8efaa75f0f77524R19
created_at: 2025-03-18T08:26:31Z
author_association: NONE
diff_hunk: @@ -0,0 +1,48 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[]
++
+[NOTE]
+====
+It will take at least 10 minutes after you enable incident detection to process the correlations and to see the timeline.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you enable the incident detection feature. Alerts resolved prior to feature enablement are not included.
path: modules/coo-incident-detection-using.adoc
user: login: ocpdocs-vale-bot
body: 🤖 **[error] RedHat.TermsErrors**: Use 'before' rather than 'prior to'. For more information, see [RedHat.TermsErrors](https://redhat-documentation.github.io/vale-at-red-hat/docs/main/reference-guide/termserrors).
created_at: 2025-03-18T12:29:39Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,48 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[]
++
+[NOTE]
+====
+It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts resolved prior to feature enablement are not included.
path: modules/coo-incident-detection-using.adoc
user: login: ocpdocs-vale-bot
body: 🤖 **[error] RedHat.TermsErrors**: Use 'before' rather than 'prior to'. For more information, see [RedHat.TermsErrors](https://redhat-documentation.github.io/vale-at-red-hat/docs/main/reference-guide/termserrors).
created_at: 2025-03-18T15:54:15Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,59 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[]
++
+[NOTE]
+====
+It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts that have been resolved before feature enablement are not included.
+====
+
+. Zoom in to a 1-day view by clicking on the drop-down to specify the duration.
++
+image::coo-incidents-timeline-daily.png[]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[]
+
+. In the list of alerts that follows, alerts are mapped to specific components, which are grouped by severity.
++
+image::coo-incident-alerts-components.png[]
+
+. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
++
+image::coo-incident-alerts-components-expanded.png[]
+
+. Click on the link for a firing alert, to see detailed information about that alert.
path: modules/coo-incident-detection-using.adoc
user: login: tmalove
body: ```suggestion
. Click the link for a firing alert, to see detailed information about that alert.
```
See ISG: https://www.ibm.com/docs/en/ibm-style?topic=word-usage#c
created_at: 2025-03-19T19:03:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,59 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[]
++
+[NOTE]
+====
+It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts that have been resolved before feature enablement are not included.
+====
+
+. Zoom in to a 1-day view by clicking on the drop-down to specify the duration.
++
+image::coo-incidents-timeline-daily.png[]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[]
+
+. In the list of alerts that follows, alerts are mapped to specific components, which are grouped by severity.
++
+image::coo-incident-alerts-components.png[]
+
+. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
++
+image::coo-incident-alerts-components-expanded.png[]
+
+. Click on the link for a firing alert, to see detailed information about that alert.
+
+
+
+[NOTE]
+====
+**Known issues**
+
+* Depending on the order of the timeline bars, the tooltip may overlap and hide the underlying bar. You can still click the bar and select the incident or alert.
path: modules/coo-incident-detection-using.adoc
user: login: tmalove
body: ```suggestion
* Depending on the order of the timeline bars, the tooltip might overlap and hide the underlying bar. You can still click the bar and select the incident or alert.
```
See ISG: https://www.ibm.com/docs/en/ibm-style?topic=word-usage#m
created_at: 2025-03-19T19:05:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,24 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="monitoring-ui-plugin"]
+= Monitoring UI plugin
+include::_attributes/common-attributes.adoc[]
+:context: monitoring-ui-plugin
+
+toc::[]
+
+:FeatureName: The {coo-full} monitoring UI plugin
+include::snippets/technology-preview.adoc[leveloffset=+2]
+
+The monitoring UI plugin adds monitoring features to the Administrator perspective of the OpenShift web console.
+
+* **{rh-rhacm}:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing {rh-rhacm} with the same monitoring capabilities as {product-title}. You can configure the plugin to fetch alerts from the {rh-rhacm} Alertmanager backend. This enables seamless integration and user experience by aligning {rh-rhacm} and {product-title} monitoring workflows.
+
+* **Incident detection:** The incident detection feature groups related alerts into incidents, to help you identify the root causes of alert bursts, instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and allows you to drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, grouped by severity. This helps you focus on the most critical areas first.
path: observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.adoc
user: login: tmalove
body: ```suggestion
* **Incident detection:** The incident detection feature groups related alerts into incidents, to help you identify the root causes of alert bursts, instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and you can drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, grouped by severity. This helps you focus on the most critical areas first.
```
Avoid transitive verb constructions.
created_at: 2025-03-19T19:16:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -9,7 +9,16 @@ toc::[]
 You can use the {coo-first} to install and manage UI plugins to enhance the observability capabilities of the {product-title} web console.
 The plugins extend the default functionality, providing new UI features for troubleshooting, distributed tracing, and cluster logging.
 
+[id="monitoring_{context}"]
+== Monitoring
 
+The monitoring UI plugin adds monitoring related UI features to the OpenShift web console, for the Advance Cluster Management (ACM) perspective and for incident detection.
+
+* **ACM:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing ACM with the same monitoring capabilities as {product-title}.
+
+* **Incident Detection:** The incident detection feature groups alerts into incidents to help you identify the root causes of alert bursts instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and allows you to drill down into the individual alerts within an incident. The system also categorizes alerts by affected component to help you focus on the most critical areas first.
path: observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
user: login: tmalove
body: ```suggestion
* **Incident Detection:** The incident detection feature groups alerts into incidents to help you identify the root causes of alert bursts instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and you can drill down into the individual alerts within an incident. The system also categorizes alerts by affected component to help you focus on the most critical areas first.
```
created_at: 2025-03-19T19:19:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -9,7 +9,16 @@ toc::[]
 You can use the {coo-first} to install and manage UI plugins to enhance the observability capabilities of the {product-title} web console.
 The plugins extend the default functionality, providing new UI features for troubleshooting, distributed tracing, and cluster logging.
 
+[id="monitoring_{context}"]
+== Monitoring
 
+The monitoring UI plugin adds monitoring related UI features to the OpenShift web console, for the Advance Cluster Management (ACM) perspective and for incident detection.
+
+* **ACM:** The monitoring plugin in {coo-first} allows it to function in {rh-rhacm-first} environments, providing ACM with the same monitoring capabilities as {product-title}.
path: observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.adoc
user: login: lihongyan1
body: Not sure if should change 'monitoring capabilities' to 'alerting capabilities'
created_at: 2025-03-21T06:43:17Z
author_association: NONE

PR comments:
user: login: ocpdocs-previewbot
created_at: 2025-03-11T17:48:16Z
body: 🤖 Fri Mar 21 15:56:44 - Prow CI generated the docs preview:

https://90113--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/cluster_observability_operator/ui_plugins/distributed-tracing-ui-plugin.html
https://90113--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/cluster_observability_operator/ui_plugins/monitoring-ui-plugin.html
https://90113--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/cluster_observability_operator/ui_plugins/observability-ui-plugins-overview.html
author_association: NONE
user: login: gabriel-rh
created_at: 2025-03-12T16:42:50Z
body: /retest
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-12T16:46:17Z
body: /retest
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-18T12:11:34Z
body: /retest
author_association: CONTRIBUTOR
user: login: falox
created_at: 2025-03-18T20:00:17Z
body: /lgtm
author_association: NONE
user: login: tmalove
created_at: 2025-03-19T18:28:06Z
body: /remove-label peer-review-needed
/label peer-review-in-progress
author_association: CONTRIBUTOR
user: login: tmalove
created_at: 2025-03-19T19:29:19Z
body: /remove-label peer-review-in-progress
/label peer-review-done
Just a few suggestions.  You might want to consider adding alt-text for the graphics at some point. Otherwise lgtm!
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-03-21T15:59:21Z
body: @gabriel-rh: all tests **passed!**


[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=openshift-docs&pr=90113). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:gabriel-rh).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: NONE
user: login: lihongyan1
created_at: 2025-03-26T05:40:54Z
body: /lgtm
author_association: NONE
user: login: sthundat
created_at: 2025-03-26T07:32:48Z
body: Incident detection is supported from 4.18+ OCP version.We need to mention it in the doc.
author_association: NONE
user: login: falox
created_at: 2025-03-26T11:27:13Z
body: > Incident detection is supported from 4.18+ OCP version.We need to mention it in the doc.

@sthundat The minimum version for incidents and other features is covered here: https://github.com/openshift/openshift-docs/pull/90578
author_association: NONE
user: login: gabriel-rh
created_at: 2025-03-31T09:04:10Z
body: /cherrypick enterprise-4.19
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:19Z
body: /cherrypick enterprise-4.18
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:29Z
body: /cherrypick enterprise-4.17
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:35Z
body: /cherrypick enterprise-4.16
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:41Z
body: /cherrypick enterprise-4.15
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:48Z
body: /cherrypick enterprise-4.14
author_association: CONTRIBUTOR
user: login: gabriel-rh
created_at: 2025-03-31T09:04:55Z
body: /cherrypick enterprise-4.13
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:04:58Z
body: @gabriel-rh: new pull request created: #91306

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765606484):

>/cherrypick enterprise-4.19


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: gabriel-rh
created_at: 2025-03-31T09:05:00Z
body: /cherrypick enterprise-4.12
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:02Z
body: @gabriel-rh: #90113 failed to apply on top of branch "enterprise-4.18":
```
Patch is empty.
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To record the empty patch as an empty commit, run "git am --allow-empty".
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"

```

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765606920):

>/cherrypick enterprise-4.18


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:15Z
body: @gabriel-rh: new pull request created: #91307

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765607329):

>/cherrypick enterprise-4.17


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:20Z
body: @gabriel-rh: new pull request created: #91308

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765607584):

>/cherrypick enterprise-4.16


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:28Z
body: @gabriel-rh: new pull request created: #91309

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765607830):

>/cherrypick enterprise-4.15


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:35Z
body: @gabriel-rh: new pull request created: #91310

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765608150):

>/cherrypick enterprise-4.14


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:39Z
body: @gabriel-rh: #90113 failed to apply on top of branch "enterprise-4.13":
```
Patch is empty.
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To record the empty patch as an empty commit, run "git am --allow-empty".
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"

```

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765608425):

>/cherrypick enterprise-4.13


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:05:48Z
body: @gabriel-rh: new pull request created: #91311

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765608689):

>/cherrypick enterprise-4.12


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: gabriel-rh
created_at: 2025-03-31T09:12:35Z
body: /cherrypick enterprise-4.18
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:13:22Z
body: @gabriel-rh: new pull request created: #91312

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765627618):

>/cherrypick enterprise-4.18


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: gabriel-rh
created_at: 2025-03-31T09:14:16Z
body: /cherrypick enterprise-4.13
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-03-31T09:15:04Z
body: @gabriel-rh: new pull request created: #91313

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/90113#issuecomment-2765634354):

>/cherrypick enterprise-4.13


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE