building incident creation actions