Each incident has a mutable status associated with it. Incidents are organized and managed by their status. Only after an incident is closed can it be exported and deleted.

Incident Statuses

• Open: An unresolved incident. This is the initial status of an incident.
• Closed by User: An incident that has been closed by a user action using the Nevelex Labs Security Flow UI.
• Closed by Flow: An incident which is automatically closed by a NL Incident Set Status node.
• Waiting: An incident's messages is waiting (pending) a user decision at a NL Waiter (waiter) node.
• Waiting Failure: When a waiter node is deleted, pending waiting incidents will move to waiting failure.

Incident Status Transition Diagram

The following status transitions diagram and table show the life cycle of incidents from initial reporting through final disposition.

Incident Status Transition Table

Incident Statuses and Transitions

Starting Status	Destination Status	Transition Reason
Start	Open	Message enters any Nevelex Labs node.
Open	Waiting	Message enters any Nevelex Labs Waiter node.
Open	Closed by Flow	Message enters a NL Incident Set Status node which is configured to change the status to Closed by Flow.
Open	Closed by User	User closes the incident via the Nevelex Labs Security Flow UI.
Waiting	Open	User selects the primary or secondary path for the Nevelex Labs Waiter node to traverse.
Waiting	Waiting Failure (node deleted)	User deletes a Nevelex Labs Waiter node with pending incidents. Once the flow is deployed, the status transition occurs.
Waiting Failure (node deleted)	Closed by User	User closes the incident via the Nevelex Labs Security Flow UI.
Closed by Flow	Open	User reopens the incident via the Nevelex Labs Security Flow UI or The message passes through a Nevelex Labs node in the flow.
Closed by Flow	End	User exports and deletes the incident from the database.
Closed by User	Open	User reopens the incident via the Nevelex Labs Security Flow UI or The message passes through a Nevelex Labs node in the flow.
Closed by User	End	User exports and deletes the incident from the database.