Documentation Grafana Cloud Alerts and IRM Workflows Configure triggers

Configure triggers

Triggers define when a workflow starts. A workflow can have an event-based trigger, a schedule-based trigger, or run only through manual execution. You can also combine event and schedule triggers in a single workflow.

Configure event triggers

Event triggers start a workflow when an event matches a pattern. Events follow the naming format {app}.{resource-type}.{event-type}.

You define event triggers using matching rules. Each matching rule contains a regular expression that the engine tests against incoming event names. If any rule matches, the workflow starts.

Add an event trigger in the editor

1. Select Event as the trigger type when creating or editing a workflow.
2. In the configuration panel, enter a regular expression pattern.

For example, a pattern of grafana_irm_app\.incident\..* triggers the workflow on any incident event.

Add event triggers in YAML

Define matching rules in the startWhen.matchingRules section of the workflow definition:

YAML Copy

startWhen:
  matchingRules:
    - eventNameRegex: "grafana_irm_app\\.incident\\.created"

You can define multiple matching rules. The workflow triggers if any rule matches:

YAML Copy

startWhen:
  matchingRules:
    - eventNameRegex: "grafana_irm_app\\.incident\\.updated"
    - eventNameRegex: "grafana_irm_app\\.alert_groups\\.fired"

Identify available event sources

The following table lists the available event sources:

Event names follow the pattern {app}.{resource-type}.{event-type}.

When a workflow triggers on an incident event (grafana_irm_app.incident.*), the engine automatically loads the full incident data into the workflow context. Steps can reference it using ${resources.incident.event.title} and similar expressions. For details, refer to Load incident data.

Similarly, when a workflow triggers on an alert group event (grafana_irm_app.alertgroup.*), the engine automatically loads the full alert group data into the workflow context. Steps can reference it using ${resources.alertgroup.event.title} and similar expressions. For details, refer to Load alert group data.

Configure schedule triggers

Schedule triggers start a workflow at recurring times using cron syntax. Schedules follow the standard five-field Unix cron format and run in UTC.

text Copy

minute  hour  day-of-month  month  day-of-week

Add a schedule trigger in the editor

1. Select Schedule as the trigger type when creating or editing a workflow.
2. In the configuration panel, enter a cron expression.

Add schedule triggers in YAML

Define schedules in the startWhen.schedules section of the workflow definition:

YAML Copy

startWhen:
  schedules:
    - "0 9 * * 1-5"

Understand cron syntax

Cron fields support wildcards (*), ranges (1-5), steps (*/10), and lists (1,3,5):

The following examples show common schedule patterns:

Trigger workflows manually

You can trigger any workflow manually through the UI or the API, regardless of whether it has event or schedule triggers configured. Manual triggers are useful for testing workflows before enabling them for automatic execution.

To manually trigger a workflow in the editor, click Test and provide sample input data as a JSON object.

Deduplicate workflow runs

The runOnceFor option prevents duplicate workflow executions for the same logical event. It takes a template string that renders against the event data to produce a deduplication key. Use ${...} segments for CEL expressions inside the template.

For example, setting runOnceFor to incident:${inputs.data.incidentID} means that if multiple events arrive for the same incident ID, the workflow runs only for the first event. This is useful when you want to react to an incident exactly once, even if the system produces several related events in quick succession.

YAML Copy

spec:
  runOnceFor: "incident:${inputs.data.incidentID}"
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\..*"

Next steps

• Create workflows
• Load incident data
• Load alert group data
• Use CEL expressions
• Step types reference