---
title: "Configure incident briefings | Grafana Cloud documentation"
description: "Configure incident briefings in Grafana IRM to automatically post standardized information into new incident Slack channels"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Configure incident briefings

Incident briefings automatically post a custom message to an incident’s Slack channel when an incident is declared or matches a filter. Use them to share runbooks, escalation procedures, checklists, or other standardized information your responders need at the start of an incident.

## Before you begin

To configure incident briefings, you need:

- A Grafana Cloud account with the required [IRM roles and permissions](/docs/grafana-cloud/alerting-and-irm/irm/set-up/manage-access/roles-and-permissions/)
- The [Grafana IRM integration for Slack](/docs/grafana-cloud/alerting-and-irm/irm/integrations/chat-and-collaboration/slack) installed and configured with **Create channel** enabled
- A linked Slack profile in your user settings to send preview messages

## Add an incident briefing

To add a new incident briefing:

1. In Grafana Cloud, navigate to **IRM** > **Integrations** > **Apps** and select **Slack**.
2. Find **Send incident briefing** and select **Run when an event fires**.
3. Choose when the briefing runs:
   
   - **Incident is declared**: Posts the briefing immediately after the incident channel is created.
   - **Incident matches a filter**: Posts the briefing when an incident matches a filter expression you define.
4. Write your briefing message in the text area using Slack markup format.
5. Select **Save** to enable the briefing.

The briefing posts to the incident’s Slack channel with a footer that reads *Sent by incident briefing*.

## Write a briefing message

You write briefing messages in Slack’s markup format. Messages can be up to 3,000 characters.

The following formatting options are available:

Expand table

| Syntax                            | Result             |
|-----------------------------------|--------------------|
| `*bold*`                          | **bold**           |
| `_italic_`                        | *italic*           |
| `~strikethrough~`                 | strikethrough      |
| `` `inline code` ``               | `inline code`      |
| ```` ```code block``` ````        | Code block         |
| `> blockquote`                    | Blockquote         |
| `<https://example.com|link text>` | Hyperlink          |
| `<@U123456>`                      | @mention a user    |
| `<#C123456>`                      | #channel reference |
| `<!here>`                         | @here              |

For guidance on structuring effective briefing messages, refer to the [Best practices](#best-practices) section of this document.

## Preview a briefing message

Before enabling a briefing, you can send a preview to your Slack direct messages to verify the formatting.

To preview a briefing:

1. Write your briefing message in the text area.
2. Select **Send test message**.
3. Check your Slack direct messages for the preview. If a permalink is available, select **Open in Slack** to view the message directly.

The preview uses the same formatting as the actual briefing, with a footer that reads *This is a preview of your incident briefing message*.

> Note
> 
> You must have a linked Slack profile to send preview messages. You can link your profile from IRM settings in your Grafana user profile. For details, refer to [Connect your Slack user to Grafana IRM](/docs/grafana-cloud/alerting-and-irm/irm/integrations/chat-and-collaboration/slack/#connect-your-slack-user-to-grafana-irm)

## Use multiple briefings

You can create multiple incident briefings, each with its own message and trigger.

For example, you might configure:

- A general briefing that posts on every incident with links to your incident response guide and escalation policy.
- A briefing filtered to `severity:critical` that posts additional procedures for critical incidents.
- A briefing filtered to `label:"service:payments"` that posts a payments-specific runbook.

## Edit a briefing

You can edit a briefing’s message after it’s saved. The trigger event and filter can’t be changed after you create the briefing. To change these, remove the briefing and create a new one.

To edit a briefing message:

1. In Grafana Cloud, navigate to **IRM** &gt; **Integrations** &gt; **Apps** and select **Slack**.
2. Find the configured briefing you want to change.
3. Select the **pencil** icon to open the editor.
4. Update the message and select **Save**.

To remove a briefing, select the **trash** icon next to the configured briefing.

## Filter briefings by incident

When you choose **Incident matches a filter** as the trigger event, you can define a filter expression to control which incidents receive the briefing.

Use incident query syntax to filter by properties such as labels, severity, or status. For complete information about filter syntax, refer to the [Incident query syntax documentation](/docs/grafana-cloud/alerting-and-irm/irm/reference/incident-query-syntax).

## Run briefings on private incidents

By default, briefings don’t run on private incidents. To include private incidents, enable the **Run this action on private incidents** toggle when configuring the briefing.

## Best practices

Consider these recommendations when configuring incident briefings:

- **Keep messages actionable**: Include links to runbooks, dashboards, and escalation contacts rather than long prose descriptions. Responders need quick access to resources, not background reading.
- **Use targeted briefings**: Create separate briefings with filters for different teams or severity levels. A payments team doesn’t need the same runbook as the infrastructure team.
- **Combine with announcements**: Use [incident announcements](/docs/grafana-cloud/alerting-and-irm/irm/manage-incidents/customize-incident-response/incident-announcements) to notify stakeholders in other channels, and briefings to provide responders with actionable information in the incident channel.
- **Preview before enabling**: Always send a test message to verify formatting and links before enabling a briefing in production.
- **Keep messages concise**: Responders scan briefings under pressure. Use short bullet points and direct links rather than paragraphs of text.

## Next steps

Learn more about related features:

- [Grafana IRM integration for Slack](/docs/grafana-cloud/alerting-and-irm/irm/integrations/chat-and-collaboration/slack)
- [Configure incident announcements](/docs/grafana-cloud/alerting-and-irm/irm/manage-incidents/customize-incident-response/incident-announcements)
- [Incident query syntax](/docs/grafana-cloud/alerting-and-irm/irm/reference/incident-query-syntax)
- [Configure private incidents](/docs/grafana-cloud/alerting-and-irm/irm/manage-incidents/customize-incident-response/private-incidents)