Incident Alert life cycle Incident alerts are created with a New state. They follow a process that finishes with the Closed or Cancelled state. A series of rules ensure that the alert progression is controlled and standardized. From New, the state can be changed to Work in Progress, Cancelled, or Resolved. if the Actions Taken field is updated, the state automatically changes from New to Work in Progress. From Work in Progress, the state can be changed to Resolved or Cancelled. Only the alert creator or a user with the admin role can cancel an incident alert. From Resolved, the state can be changed to Closed.