Components affected by an incident have the following states defined by default:
Operational- everything working fine
Disrupted- non-fatal problems (performance, random errors)
Down- fatal, the component is not usable
Monitoring- the component recently experienced issues and is being watched closely by the team.
The usual flow follows the path of
Operational -> Disrupted OR Down -> Monitoring -> Operational. It's also reasonable to go
Operational -> Monitoring -> Operational in some cases.