---
title: Incidents
description: The incident queue at
---

# Incidents



## Purpose

INCIDENTS is the review queue: every enriched detection with its grade and classification. Clicking a row opens the full record at `#/incidents/:id` with the exact factor scores behind its grade.

Deep link: `ops.useargus.co/#/incidents` (nav group MONITOR).

## What it shows

**List view.** A filter toolbar and a table with columns: captured, tenant, camera, risk, rating, confirmation. A legend under the filters explains the columns: RISK is the model risk score (0 to 1), RATING is the letter grade (click the chip for the factor breakdown), CONFIRMATION is the operator review state.

Filters:

* Min rating: any, AAA, AA, A, BBB, BB, B, CCC, CC, C, D.
* Confirmation: any, unreviewed, true positive, false positive, disputed, inconclusive.
* Camera: a dropdown auto-populated from the cameras present in the loaded rows.
* Limit: 50, 100, 200, 500 (default 100).

**Detail view** (`#/incidents/:id`), with a back link to the list:

* Facts: id, alert id, incident, tenant, camera, captured, risk score, risk level, confidence, data quality, confirmation, consent export, consent resale, bytes, R2 prefix, and the rating chip.
* Review: a Confirmation dropdown (unreviewed, confirmed\_true\_positive, confirmed\_false\_positive, disputed, inconclusive) and an optional Notes field.
* Tags: the record's tags, each removable, plus an input to add one (for example `shoplift_confirmed`).
* Manifest: the R2-hosted artifacts with signed download links and sizes.

The rating rubric (composite formula, factor weights, bucketing, classification enum) is documented in the console's HELP panel.

## Actions

* SAVE REVIEW saves the confirmation and notes; the review pane repaints in place and a toast confirms.
* ADD appends a tag (recorded with source `reviewer:ui`); the small x on a tag removes it. Both patch only the tags section.
* No step-up confirmation is required for review or tags.

## Matching CLI

```bash
argusctl incidents list --tenant <id> --classification <c> --from <iso> --to <iso>
```

See [argusctl incidents](/docs/cli/incidents).

## Notes

* The list auto-refreshes on the 15 second timer quietly: existing rows stay visible while the refetch is in flight. Changing any filter reloads immediately.
* The detail view does not poll; mutations repaint their own pane in place.
* Empty state: "no incidents match". The manifest pane shows "no R2 objects" when R2 is unconfigured or the links expired (non-fatal).


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)