Skip to main content
Plans: Core and Plus, and the free trial. Who: any member pages on-call from an incident and acknowledges a page; owners and admins send test pages and cancel pages.
A page is a text message to the person on call, with a link to acknowledge it. If nobody acknowledges, Pharus texts the next person in the rota: the backup after 15 minutes, then the final escalation. Pharus places no phone calls. Being on call is the opt-in: switching off alert emails or the digest under Settings → Notifications doesn’t stop pages.

​
What starts a page

Some things never page:
  • A name-only match. It waits for a person to confirm it on the Vulnerabilities page, as described in Vulnerabilities.
  • An incident you declare by hand or open from a disclosure report. Page on-call yourself if it can’t wait; otherwise the deadline warning pages 4 hours before its first report is due.
  • A final-report warning. It goes out 72 hours ahead by email and in the notification bell, not by SMS.
  • A deadline warning for an incident that an open page already covers.
  • A drill. Its only page is the test page you can send when you start it.
  • Anything in a read-only workspace (on Free, or closed): monitoring and the clocks are paused there. A page that was already under way still escalates.
Pharus starts at most 10 pages per workspace per hour. Escalations of a page already open don’t count towards the limit.

​
Page on-call from an incident

1

Open the incident

Open the incident in Incidents.
2

Select Page on-call

Select Page on-call next to the incident’s title. The dialog, Page the person on call?, names who Pharus texts now and who it escalates to if nobody acknowledges.
3

Send it

Select Send page. A banner, Paging on-call, appears on the incident with who was texted, when, and when it escalates.
Page on-call isn’t shown on a closed incident, on a drill, while a page for the incident is open, on Starter, or in a read-only workspace. If nobody on call has a verified mobile number, the dialog says so: “Nobody on call has a verified mobile number right now, so owners and admins will be emailed instead.” No text goes out, and owners and admins get an email, “Nobody on call could be paged”.

​
What the text says

The text names the incident, the vulnerability and the product family, the next deadline in Oslo time with the time left, and the acknowledgement link:
  • A text sent after an earlier step went unacknowledged starts “Pharus, escalated:”.
  • A page someone sent from an incident names them: “Kari Nordmann paged you about INC-0042”.
  • A test page starts “Pharus TEST:” and asks for nothing: “Kari Nordmann sent a test page. No action needed.”
  • The text is in the recipient’s language, set under Settings → Your profile, or the company’s default language.
  • It stays within 300 characters. When it would be longer, Pharus drops detail step by step, the CVE and product family before the deadline. The link is never cut.
Channels. Pages go out as SMS, or as RCS on phones and networks that support it. Where Pharus offers WhatsApp, a member can switch on Page me on WhatsApp instead of SMS under Settings → Notifications to get pages there instead. Phone verification codes always come by SMS.

​
Acknowledge a page

Acknowledging tells your team you have it and stops the escalation. There are two ways:
Open the link in the text. The page shows the Company, the Incident, the Vulnerability, the Product family, who it was Sent to, when it was Paged and its Status, in Oslo time. Select Acknowledge page. You don’t need to sign in.Opening the link doesn’t acknowledge anything on its own, so link previews and scanners on your phone or in your mail can’t acknowledge for you. The link works for 24 hours and acknowledges in the name of the person it was sent to.
When you acknowledge:
  • The escalation stops. Nobody else is texted about the page.
  • The link page confirms it: “Acknowledged at 22:51 CEST. The escalation has stopped.” If someone else got there first, it says who and when.
  • The audit trail records who acknowledged and when, on every incident the page covers.
Acknowledging again changes nothing. A page whose escalation has ended can still be acknowledged. If the link has expired or was cut short, sign in to Pharus and acknowledge the page from the incident.

​
How escalation works

Each page has a chain of up to three people, taken from the rota at the moment the page starts: the Primary, the Backup and the Final escalation. With the default times, and a backup and a final escalation set: The rules behind it:
  • Timing comes from the rota. Escalate to backup after sets the 15 minutes; Final escalation after sets the 120, counted from the start of the page. Everyone texted gets at least the backup time before the next person is texted, and the escalation ends once the last person in the chain has had it too.
  • People are skipped when nobody is assigned to a step, when the same person was already texted at an earlier step, or when they have no phone number or haven’t verified it. If the primary is skipped, the first person who can be reached is texted at once. The incident’s banner lists who was skipped and why, for example “Skipped: Jonas Berg (phone not verified).”
  • A text that fails moves on. If a text can’t be sent, or the network reports it undelivered, the page moves to the next person at the next minute instead of waiting out the 15 minutes.
  • A handoff doesn’t change the chain. A page that starts before a handoff keeps the people who were on call when it started.
So without a backup or a final escalation, the escalation ends 15 minutes after the primary was texted. Without a final escalation, it ends 15 minutes after the backup was texted. Without a backup, the final escalation is texted at its own time, 120 minutes after the start by default. When the escalation ends without an acknowledgement, the incident’s banner turns to Nobody acknowledged the page, and owners and admins with alert emails on get an email, “Nobody acknowledged the page for INC-0042”. If none of them has alert emails on, every owner gets it. The banner and the bell keep showing the page for 24 hours, and anyone can still acknowledge it.

​
Cancel a page

Owners and admins can stop a page that is still open, for example when the incident is already being handled in the office.
1

Open the incident

Open the incident with the Paging on-call banner.
2

Cancel it

Select Cancel page. Add a Reason if you want, then select Cancel page again. Keep paging closes the dialog without cancelling.
Nobody else is texted about the page, and the cancellation is logged on the incident with the reason. Someone who opens a link to a cancelled page sees “This page was cancelled”.

​
Send a test page

Owners and admins can check the rota end to end without an incident.
1

Open the on-call settings

Go to Settings → On-call.
2

Send it

In the Paging card, select Send test page. The dialog names who Pharus texts: the first person on call with a verified number. Select Send test page again.
The text says it is a test. Until someone acknowledges, it escalates like a real page, so a test also shows whether the backup and the final escalation are reachable. If nobody acknowledges, owners and admins get an email that asks them to check the numbers on the rota.

​
What is logged

  • Audit trail, on each incident the page covers: “Paged on-call” (with who, and SMS or WhatsApp), “Escalated after 15 min” (with who), “Acknowledged page”, “Escalation ended without acknowledgement” and “Cancelled page” (with the reason). A test page gets the same events without an incident. See Audit trail.
  • Delivery problems: owners and admins see texts that didn’t arrive, with the reason given, under Settings → Notifications. See Notifications.
  • Board report: pages sent, acknowledged, the median time to acknowledge, escalations and pages nobody acknowledged, per quarter. See Board report.
A page that is already open can always be acknowledged or cancelled, also after a move to Starter or while the workspace is read-only.

On-call rota

Notifications

Reporting clocks

Drills