OBSDOCS-2705 Incident detection changes

Author: gabriel-rh

images/coo-incident-alerts-components-expanded.png

@@ -13,25 +13,43 @@
 * You have installed the {coo-full}.
 * You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
 
+[NOTE]
+====
+If you have installed the {coo-full} programmatically, make sure that the namespace (by default `openshift-cluster-observability-operator`) has the label `openshift.io/cluster-monitoring=true`. If not add it by running the comand:
+
+[source,terminal]
+----
+$ oc label namespace openshift-cluster-observability-operator openshift.io/cluster-monitoring=true 
+----
+
+====
+
 
 .Procedure
 
-. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+. In the Administrator perspective of the web console, click on *Observe* -> *Alerting* and choose the **Incidents** tab.
 
 . The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
 +
 image::coo-incidents-timeline-weekly.png[Weekly incidents timeline]
 +
 [NOTE]
 ====
-It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+It will take at least five minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+Status changes are recorded at five-minute intervals. You can see the last update time next to the timeline. 
 
 The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts that have been resolved before feature enablement are not included.
 ====
 
 . Zoom in to a 1-day view by clicking on the drop-down to specify the duration.
 +
 image::coo-incidents-timeline-daily.png[Daily incidents timeline]
++
+[NOTE]
+====
+For performance reasons, the UI only loads the displayed data. The start time reflects the first data point rendered in the current timeline, not the absolute start time of the alert. For example, if you zoom to 1-day and an alert started two days ago, the start time will be shifted to twenty four hours before.
+====
 
 . By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
 +
@@ -41,18 +59,9 @@ image::coo-incident-alerts-timeline.png[Incidents alerts timeline]
 +
 image::coo-incident-alerts-components.png[Incidents alerts components]
 
-. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
+. Click to expand a component in the list. The underlying alerts related to that component are displayed.
 +
 image::coo-incident-alerts-components-expanded.png[Incidents expanded components]
 
-. Click the link for a firing alert, to see detailed information about that alert.
-
-
-
-[NOTE]
-====
-**Known issues**
-
-* Depending on the order of the timeline bars, the tooltip might overlap and hide the underlying bar. You can still click the bar and select the incident or alert.
+. Click the link for an alert, to see detailed information about the associated alert rule.
 
-====

images/coo-incident-alerts-components.png

@@ -6,9 +6,6 @@ include::_attributes/common-attributes.adoc[]
 
 toc::[]
 
-:FeatureName: The {coo-full} monitoring UI plugin
-include::snippets/technology-preview.adoc[leveloffset=+2]
-
 The monitoring UI plugin adds monitoring features to the Administrator perspective of the {ocp-product-title} web console.
 
 include::snippets/unified-perspective-web-console.adoc[]
@@ -17,7 +14,7 @@ include::snippets/unified-perspective-web-console.adoc[]
 
 * **Incident detection:** The incident detection feature groups related alerts into incidents, to help you identify the root causes of alert bursts, instead of being overwhelmed by individual alerts. It presents a timeline of incidents, color-coded by severity, and you can drill down into the individual alerts within an incident. The system also categorizes alerts by affected component, grouped by severity. This helps you focus on the most critical areas first.
 +
-The incident detection feature is available in the {ocp-product-title} web console at **Observe** -> **Incidents**.
+The incident detection feature is available in the {ocp-product-title} web console by clicking on **Observe** -> **Alerting** and choosing the **Incidents** tab.
 
 include::modules/coo-monitoring-ui-plugin-install.adoc[leveloffset=+1]