diff --git a/documentation/INCIDENTS.md b/documentation/INCIDENTS.md
index e6bbaed..84a3b8d 100644
--- a/documentation/INCIDENTS.md
+++ b/documentation/INCIDENTS.md
@@ -147,3 +147,15 @@ There was a power outage in tent 5 taking down `sw-access02` and therefore also
 Currently every visit from Freifunkas need to be coordinated with the object management of the facility.
 This is fine for sheduled maintenances but not doeable for incident response and often leads to discussions and unaccessible equipment (which is totally understandable).
 Maybe we can "whitelist" certain people at the facility so they can always access the equipment without further authorization.
+
+2022.07.25 01:00 | (maintenance) os upgrades
+--------------------------------------------
+
+OS upgrades of non-customer facing machines/services
+
+**impact**: short downtime of the monitoring
+
+**upgrades**:
+* `monitoring01`:   `apt update && apt dist-upgrade -y && reboot` (downtime: 00:58 - 00:59)
+* `hyper01`:        `apt update && apt dist-upgrade -y && reboot` (downtime: 01:09 - 01:10)
+* `eae-adp-jump01`: `syspatch && rcctl restart cron`