Skip to main content
This guide builds an automation rule — declarative when → then automation that runs an action whenever an incident event matches your conditions. Automation rules are available on every plan and involve no AI and no approval step. We’ll build a common one: when a critical incident opens, post to #major-incidents.

​
Prerequisites

  • Permission to manage automation rules in your organization.
  • The integration your action needs — for a post-to-channel action, a connected Slack workspace.
1

Open Automation Rules

In the dashboard, go to Automation Rules and click New rule.
2

Name the rule and pick the event

Give the rule a clear name (e.g. “Announce critical incidents”). Choose the when event:
  • incident.created
  • incident.acknowledged
  • incident.resolved
For this example, choose incident.created.
3

Add conditions

Add an equality condition severity = critical. You can add more conditions — for example component = payments — and all of them must hold for the rule to fire. Leave conditions empty to act on every incident for the event.
4

Choose the action

Pick the then action and fill in its fields. The available actions are post to channel, create ticket, attach runbook, and call webhook — the same set as proposed actions. For this example, choose Post to channel and set the message and target channel.
5

Enable and save

Make sure the rule is enabled, then save. It now fires on every matching incident. Toggle it off later to pause it without deleting it.
An action fired by a rule is attributed to the rule’s author, not to whoever acknowledged or resolved the incident.

​
Manage rules over the API

Rules can also be managed over the /v1 API — see Automation rules → API. Authenticate with an API key as described in Authentication.

​
Rules vs. proposed actions

If you want the AI to suggest an action during an incident for a human to approve, that’s a proposed action, not an automation rule. Automation rules fire on events you choose, with no approval step.