---
title: "Get started with Grafana Workflows | Grafana Cloud documentation"
description: "Create your first Grafana Workflow by building an incident response automation that creates a Slack channel, assigns a commander, and posts a notification."
---

# Get started with Grafana Workflows

> Note
> 
> Grafana Workflows is currently in [private preview](/docs/release-life-cycle/). Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available.

This guide walks you through creating your first workflow in Grafana Workflows. You’ll build an incident response automation that reacts when a critical incident is created, creates a Slack channel, assigns a commander, and posts a summary.

## Before you begin

To complete this guide, you need:

- A Grafana Cloud account with Workflows enabled for your stack
- Access to a Slack workspace connected to your Grafana Cloud instance

## Create a workflow

1. In Grafana, navigate to **More apps** and open the **Workflows** app.
2. Click **New workflow**.
3. Enter a name for your workflow, for example, “Critical Incident Response”.

### Choose a trigger

The first step is to choose when your workflow runs. For this example, you’ll trigger the workflow when an incident is updated.

1. Select **Event** as the trigger type, then choose “Incident updated.”

### Add a filter step

To respond only to critical incidents, add a filter step.

1. Click **+** on the last node in the workflow tree.
2. Search for “filter” in the action palette and select it.
3. In the condition field, enter:
   
   text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```text
   inputs.data.severity == 'critical'
   ```
   
   The workflow stops if the condition evaluates to `false`.

### Add a Slack channel step

1. Click **+** to add another step.
2. Search for “Create Slack channel” and select it.
3. Set the channel name to `inc-${inputs.data.incidentID}`.

### Add a commander assignment step

1. Click **+** to add another step.
2. Search for “Add participant to incident” and select it.
3. Set the incident ID to `${inputs.data.incidentID}`.
4. Set the user ID to the email or user ID of your on-call commander.
5. Set the role to `commander`.

### Add a notification step

1. Click **+** to add another step.
2. Search for “Post message to Slack channel” and select it.
3. Set the channel ID to `${steps.create-channel.outputs.channelID}` to post to the channel you just created.
4. Set the message text to:
   
   text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```text
   Incident ${inputs.data.incidentID}: ${inputs.data.title}
   Severity: ${inputs.data.severity}
   Commander assigned.
   ```

## Test the workflow

1. Click **Test** in the header.
2. Enter a JSON object as the test input, for example:
   
   JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```json
   {
     "incidentID": "123",
     "title": "Database connection pool exhausted",
     "severity": "critical"
   }
   ```
3. Click **Run**. The test executes the workflow and you can view the results in **Runs**.

## Enable the workflow

After testing, toggle the workflow to enabled so it runs automatically when matching events arrive.

## View the workflow definition

Click **JSON** in the header to view the complete workflow definition. The following YAML shows the equivalent definition for the workflow you built:

YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```yaml
apiVersion: workflows.ext.grafana.com/v1alpha1
kind: Definition
metadata:
  name: critical-incident-response
spec:
  name: "Critical Incident Response"
  enabled: true
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\.created"
  steps:
    - id: check-severity
      type: filter
      inputs:
        condition: "inputs.data.severity == 'critical'"

    - id: create-channel
      type: slack.channel.create
      inputs:
        channelName: "inc-${inputs.data.incidentID}"

    - id: assign-commander
      type: incident.add-participant
      inputs:
        incidentID: "${inputs.data.incidentID}"
        userID: "oncall@example.com"
        role: "commander"

    - id: post-summary
      type: slack.message.post
      inputs:
        channelID: "${steps.create-channel.outputs.channelID}"
        messageText: "Incident ${inputs.data.incidentID}: ${inputs.data.title}\nSeverity: ${inputs.data.severity}\nCommander assigned."
```

## Next steps

- [Create workflows](/docs/grafana-cloud/alerting-and-irm/workflows/create-workflows)
- [Configure triggers](/docs/grafana-cloud/alerting-and-irm/workflows/configure-triggers)
- [Use CEL expressions](/docs/grafana-cloud/alerting-and-irm/workflows/use-expressions)
- [Step types reference](/docs/grafana-cloud/alerting-and-irm/workflows/reference)