Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Alerts and IRMbreadcrumb arrow Workflowsbreadcrumb arrow Get started
Grafana Cloud
Last reviewed: May 21, 2026

Get started with Grafana Workflows

Note

Grafana Workflows is currently in private preview. Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available.

This guide walks you through creating your first workflow in Grafana Workflows. You’ll build an incident response automation that reacts to updates on critical incidents, creates a Slack channel, assigns a commander, and posts a summary.

Before you begin

To complete this guide, you need:

  • A Grafana Cloud account with Workflows enabled for your stack
  • Access to a Slack workspace connected to your Grafana Cloud instance

Create a workflow

  1. In Grafana, navigate to More apps and open the Workflows app.
  2. Click New workflow.
  3. Enter a name for your workflow, for example, “Critical Incident Response”.

Choose a trigger

The first step is to choose when your workflow runs. For this example, you’ll trigger the workflow when an incident is updated. The filter step you add next narrows that down to critical incidents only.

  1. Select Event as the trigger type, then choose Incident updated.

Add a filter step

To respond only to critical incidents, add a filter step.

  1. Click + on the last node in the workflow tree.

  2. Search for “filter” in the action palette and select it.

  3. In the condition field, enter:

    text 
    inputs.data.severity == 'critical'

    The workflow stops if the condition evaluates to false.

Add a Slack channel step

  1. Click + to add another step.
  2. Search for “Create Slack channel” and select it.
  3. Set the channel name to inc-${inputs.data.incidentID}.

Add a commander assignment step

  1. Click + to add another step.
  2. Search for “Add participant to incident” and select it.
  3. Set the incident ID to ${inputs.data.incidentID}.
  4. Set the user ID to the email or user ID of your on-call commander.
  5. Set the role to commander.

Add a notification step

  1. Click + to add another step.

  2. Search for “Post message to Slack channel” and select it.

  3. Set the channel ID to ${steps.create-channel.outputs.channelID} to post to the channel you just created.

  4. Set the message text to:

    text 
    Incident ${inputs.data.incidentID}: ${inputs.data.title}
Severity: ${inputs.data.severity}
Commander assigned.

Test the workflow

  1. Click Run in the editor header.

  2. In the Trigger Workflow dialog, replace the placeholder event with the following JSON, then click Trigger Workflow.

    JSON 
    {
  "id": "example-message-id",
  "type": "grafana_irm_app.incident.updated",
  "source": "grafana_irm_app/100",
  "time": "2026-05-21T15:00:00Z",
  "data": {
    "incidentID": "123",
    "title": "Database connection pool exhausted",
    "severity": "critical"
  }
}

    Workflows expects an event in CloudEvents shape. The fields under data become available in your steps as inputs.data.*. The other fields (id, type, source, time) describe the event itself.

  3. To see the results, click the arrow next to Run to open the Latest runs panel. Select the run to inspect each step’s inputs and outputs.

Enable the workflow

After testing, click Save to persist your workflow, then toggle the Enable switch in the header so it runs automatically when matching events arrive.

View the workflow definition

Open the More menu in the editor header and select View JSON to view the complete workflow definition. The following YAML shows the equivalent definition for the workflow you built:

YAML 
apiVersion: workflows.ext.grafana.com/v1alpha1
kind: Definition
metadata:
  name: critical-incident-response
spec:
  name: "Critical Incident Response"
  enabled: true
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\.updated"
  steps:
    - id: check-severity
      type: filter
      inputs:
        condition: "inputs.data.severity == 'critical'"

    - id: create-channel
      type: slack.channel.create
      inputs:
        channelName: "inc-${inputs.data.incidentID}"

    - id: assign-commander
      type: incident.add-participant
      inputs:
        incidentID: "${inputs.data.incidentID}"
        userID: "oncall@example.com"
        role: "commander"

    - id: post-summary
      type: slack.message.post
      inputs:
        channelID: "${steps.create-channel.outputs.channelID}"
        messageText: "Incident ${inputs.data.incidentID}: ${inputs.data.title}\nSeverity: ${inputs.data.severity}\nCommander assigned."

Next steps