Acknowledge or Snooze?
Both apply to an open incident, and both stop repeat notifications. The difference is what they say and how long they last.
| Acknowledge | Snooze | |
|---|---|---|
| Meaning | Someone has this incident | Don't remind us for a while |
| Lasts | Until someone removes it | 1 to 168 hours |
| Repeat notifications | Stop | Stop while snoozed |
| Escalation policy | Stops | Pauses |
| Recovery notifications | Still sent | Still sent |
If the check fails again after it recovers, that is a new incident, and it starts out unacknowledged.
Acknowledge an Incident
From the Dashboard
Open the incident and select Acknowledge. The incident shows an Acknowledged badge with who did it and when, and an Acknowledged note is added to its timeline. To undo it, select Unacknowledge, and repeat notifications resume.
Saving a note of the Acknowledged type on the incident does the same thing.
To work through several at once, select them in the open incidents list and acknowledge them together. The list can also be filtered to Unacknowledged or Acknowledged incidents.
From the Alert Email
Down alert emails include an Acknowledge button. It opens a page that asks you to confirm, so a mail scanner that follows links can't acknowledge the incident by accident. The link is signed, stops working after 24 hours, and is tied to the person it was sent to.
From Slack
Alerts sent through the Slack app have an Acknowledge button. The message updates to show who acknowledged it. The person clicking needs write access for that channel in Xitoring and access to the server the incident belongs to.
From Microsoft Teams
Alerts sent through the Microsoft Teams app have an Acknowledge button, and the bot replies to confirm who acknowledged it. Alerts sent through a Teams Workflows webhook don't have this button.
From the API or an AI Agent
Use POST /api/v2/incidents/{id}/acknowledge, or POST /api/v2/incidents/acknowledge with up to 100 IDs. DELETE /api/v2/incidents/{id}/acknowledge removes the acknowledgement. The MCP server also has an acknowledge_incident tool.
Snooze an Incident
Open the incident, select Snooze, and pick 1 hour, 4 hours, 1 day, 7 days, or Custom… for any whole number of hours from 1 to 168. Snoozing again replaces the previous snooze. To stop early, select End snooze.
Through the API, use POST /api/v2/incidents/{id}/snooze with hours, and DELETE /api/v2/incidents/{id}/snooze to end it. The MCP server has a snooze_incident tool.
Who Can Do This
Anyone who can view the server an incident belongs to can acknowledge or snooze it. Only open incidents can be acknowledged or snoozed.
Related Resources
- Creating Alert Escalation Policies — what happens when nobody acknowledges
- On-Call Schedules — rotations, overrides, and cover requests
- Notification Channels — where alerts can be delivered