Documentation Grafana Cloud Alerts and IRM Workflows Get started

Get started with Grafana Workflows

This guide walks you through creating your first workflow in Grafana Workflows. You’ll build an incident response automation that reacts when a critical incident is created, creates a Slack channel, assigns a commander, and posts a summary.

Before you begin

To complete this guide, you need:

• A Grafana Cloud account with Workflows enabled for your stack
• Access to a Slack workspace connected to your Grafana Cloud instance

Create a workflow

1. In Grafana, navigate to More apps and open the Workflows app.
2. Click New workflow.
3. Enter a name for your workflow, for example, “Critical Incident Response”.

Choose a trigger

The first step is to choose when your workflow runs. For this example, you’ll trigger the workflow when an incident is updated.

1. Select Event as the trigger type, then choose “Incident updated.”

Add a filter step

To respond only to critical incidents, add a filter step.

1. Click + on the last node in the workflow tree.

2. Search for “filter” in the action palette and select it.

3. In the condition field, enter:

   text Copy

   inputs.data.severity == 'critical'

   The workflow stops if the condition evaluates to false.

Add a Slack channel step

1. Click + to add another step.
2. Search for “Create Slack channel” and select it.
3. Set the channel name to inc-${inputs.data.incidentID}.

Add a commander assignment step

1. Click + to add another step.
2. Search for “Add participant to incident” and select it.
3. Set the incident ID to ${inputs.data.incidentID}.
4. Set the user ID to the email or user ID of your on-call commander.
5. Set the role to commander.

Add a notification step

1. Click + to add another step.

2. Search for “Post message to Slack channel” and select it.

3. Set the channel ID to ${steps.create-channel.outputs.channelID} to post to the channel you just created.

4. Set the message text to:

   text Copy

   Incident ${inputs.data.incidentID}: ${inputs.data.title}
   Severity: ${inputs.data.severity}
   Commander assigned.

Test the workflow

1. Click Test in the header.

2. Enter a JSON object as the test input, for example:

   JSON Copy

   {
     "incidentID": "123",
     "title": "Database connection pool exhausted",
     "severity": "critical"
   }

3. Click Run. The test executes the workflow and you can view the results in Runs.

Enable the workflow

After testing, toggle the workflow to enabled so it runs automatically when matching events arrive.

View the workflow definition

Click JSON in the header to view the complete workflow definition. The following YAML shows the equivalent definition for the workflow you built:

YAML Copy

apiVersion: workflows.ext.grafana.com/v1alpha1
kind: Definition
metadata:
  name: critical-incident-response
spec:
  name: "Critical Incident Response"
  enabled: true
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\.created"
  steps:
    - id: check-severity
      type: filter
      inputs:
        condition: "inputs.data.severity == 'critical'"

    - id: create-channel
      type: slack.channel.create
      inputs:
        channelName: "inc-${inputs.data.incidentID}"

    - id: assign-commander
      type: incident.add-participant
      inputs:
        incidentID: "${inputs.data.incidentID}"
        userID: "oncall@example.com"
        role: "commander"

    - id: post-summary
      type: slack.message.post
      inputs:
        channelID: "${steps.create-channel.outputs.channelID}"
        messageText: "Incident ${inputs.data.incidentID}: ${inputs.data.title}\nSeverity: ${inputs.data.severity}\nCommander assigned."

Next steps

• Create workflows
• Configure triggers
• Use CEL expressions
• Step types reference