An incident rule in AppMon is a mapping between measured thresholds and the actions to be taken when such thresholds are violated. If all the thresholds defined in the incident rule are violated, this is an incident, even if no actions have been configured for the incident rule.

Incident rules can be based on multiple measures and different severity levels of threshold violations to trigger notifications. Threshold checks are made every 10 seconds.