Incident Initiation: Pinpointing the Precise Problem Point

A question about incident timelines to help you start your day.

1. On Thursday you raise the rate limit on an API end point.
2. On Friday traffic levels start to rise due to a bot.
3. On Saturday the API becomes unavailable due to a DDOS.

When did the incident start?