Documentation Grafana Cloud Alerts and IRM IRM Manage incidents Customize incident response Incident briefings

Configure incident briefings

Incident briefings automatically post a custom message to an incident’s Slack channel when an incident is declared or matches a filter. Use them to share runbooks, escalation procedures, checklists, or other standardized information your responders need at the start of an incident.

Before you begin

To configure incident briefings, you need:

• A Grafana Cloud account with the required IRM roles and permissions
• The Grafana IRM integration for Slack installed and configured with Create channel enabled
• A linked Slack profile in your user settings to send preview messages

Add an incident briefing

To add a new incident briefing:

1. In Grafana Cloud, navigate to IRM > Integrations > Apps and select Slack.
2. Find Send incident briefing and select Run when an event fires.
3. Choose when the briefing runs:
   • Incident is declared: Posts the briefing immediately after the incident channel is created.
   • Incident matches a filter: Posts the briefing when an incident matches a filter expression you define.
4. Write your briefing message in the text area using Slack markup format.
5. Select Save to enable the briefing.

The briefing posts to the incident’s Slack channel with a footer that reads Sent by incident briefing.

Write a briefing message

You write briefing messages in Slack’s markup format. Messages can be up to 3,000 characters.

The following formatting options are available:

For guidance on structuring effective briefing messages, refer to the Best practices section of this document.

Preview a briefing message

Before enabling a briefing, you can send a preview to your Slack direct messages to verify the formatting.

To preview a briefing:

1. Write your briefing message in the text area.
2. Select Send test message.
3. Check your Slack direct messages for the preview. If a permalink is available, select Open in Slack to view the message directly.

The preview uses the same formatting as the actual briefing, with a footer that reads This is a preview of your incident briefing message.

Use multiple briefings

You can create multiple incident briefings, each with its own message and trigger.

For example, you might configure:

• A general briefing that posts on every incident with links to your incident response guide and escalation policy.
• A briefing filtered to severity:critical that posts additional procedures for critical incidents.
• A briefing filtered to label:"service:payments" that posts a payments-specific runbook.

Edit a briefing

You can edit a briefing’s message after it’s saved. The trigger event and filter can’t be changed after you create the briefing. To change these, remove the briefing and create a new one.

To edit a briefing message:

1. In Grafana Cloud, navigate to IRM > Integrations > Apps and select Slack.
2. Find the configured briefing you want to change.
3. Select the pencil icon to open the editor.
4. Update the message and select Save.

To remove a briefing, select the trash icon next to the configured briefing.

Filter briefings by incident

When you choose Incident matches a filter as the trigger event, you can define a filter expression to control which incidents receive the briefing.

Use incident query syntax to filter by properties such as labels, severity, or status. For complete information about filter syntax, refer to the Incident query syntax documentation.

Run briefings on private incidents

By default, briefings don’t run on private incidents. To include private incidents, enable the Run this action on private incidents toggle when configuring the briefing.

Best practices

Consider these recommendations when configuring incident briefings:

• Keep messages actionable: Include links to runbooks, dashboards, and escalation contacts rather than long prose descriptions. Responders need quick access to resources, not background reading.

• Use targeted briefings: Create separate briefings with filters for different teams or severity levels. A payments team doesn’t need the same runbook as the infrastructure team.

• Combine with announcements: Use incident announcements to notify stakeholders in other channels, and briefings to provide responders with actionable information in the incident channel.

• Preview before enabling: Always send a test message to verify formatting and links before enabling a briefing in production.

• Keep messages concise: Responders scan briefings under pressure. Use short bullet points and direct links rather than paragraphs of text.

Next steps

Learn more about related features:

• Grafana IRM integration for Slack
• Configure incident announcements
• Incident query syntax
• Configure private incidents