Sleuth will pick up on changes you make to incidents after they've come into Sleuth. Each day, Sleuth will re-evaluate 30 days of incident history looking for incident deletion, the merging of 2 incidents into 1, or updates to incident metadata (start/end dates, severity, incident types, etc.) and will recalculate Failure and MTTR metrics accordingly.