This appears to have been requested before and I would like to register an additional vote for the ability for users to add some type of tag or label to an incident and then use that information later for analysis. I have not had much luck finding anything to this effect in the knowledge base and would love a nudge in the right direction if the feature does now exist.
In my specific case, we have a few monitoring tools in place, for different types of services and equipment, all routing information to PagerDuty as the broadcaster for alerts. We suspect one of these is flaky and causing a lot of false alarms, contributing to alert fatigue.
The ability to add a label or two to an incident to indicate if it was a false alarm and where it came from when it is resolved would help greatly in quantifying the extent and drivers of the problem and justifying the time and budget to address it.