---
title: "Get started with Grafana Workflows | Grafana Cloud documentation"
description: "Create your first Grafana Workflow by building an incident response automation that creates a Slack channel, assigns a commander, and posts a notification."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Get started with Grafana Workflows

> Note
> 
> Grafana Workflows is currently in [public preview](/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

This guide walks you through creating your first workflow in Grafana Workflows. You’ll build an incident response automation that runs when a critical incident is declared, creates a Slack channel, assigns a commander, and posts a summary.

## Before you begin

To complete this guide, you need:

- The Editor basic role and `workflows:write`. For details, refer to [Manage access](/docs/grafana-cloud/platform/workflows/manage-access).
- A Grafana folder you can edit. Every workflow is saved in a folder, and you can’t save one until a folder exists.
- Grafana IRM with Slack connected. For details, refer to [Configure Slack for Grafana IRM](/docs/grafana-cloud/alerting-and-irm/irm/integrations/chat-and-collaboration/slack/).
- The email address of the person you want to assign as commander.
- A critical incident to test with. A [drill incident](/docs/grafana-cloud/alerting-and-irm/irm/manage-incidents/declare-incident/#declare-a-drill-incident) works.

## Create a workflow

1. In Grafana Cloud, open the **Workflows** app.
2. Go to **Manage workflows** and click **New workflow**.
3. In the **Create workflow** dialog box, click **Start from scratch**.
4. Click the workflow title and enter a name, for example, “Critical Incident Response”.

### Choose a trigger

The trigger decides when your workflow runs. For this example, the workflow runs when an incident is declared. IRM sends an **Incident Updated** event for every change to an incident, so a filter on the trigger keeps only the event IRM sends when an incident is declared.

1. Click the trigger node, select **Event**, then select **Incident Updated**.
2. In the **Filter** field, enter:
   
   text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```text
   inputs.data.eventKind == 'incident_created'
   ```

### Load the incident

An incident event carries the incident ID and a description of what changed, but not the full incident. Fields such as the title and severity come from the incident itself, which Workflows loads as `resources.incident.event`. Workflows loads it for you when an IRM event starts the workflow, but not when you start a run with **Run**. Declare the incident so it loads in both cases.

1. Open the **More** menu in the editor header and select **Settings**.
2. Select the **Resources** tab and click **Add Resource**.
3. Set the type to **Incident**, the name to `event`, and the URI to `incident://id/${inputs.data.incidentID}`.

### Add a filter step

To respond only to critical incidents, add a filter step.

1. Click **+** on the last node in the workflow tree.
2. Search for “Filter” in the action palette and select it.
3. In **Condition**, enter:
   
   text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```text
   resources.incident.event.severity.matches('(?i)^critical$')
   ```
   
   The workflow stops if the condition evaluates to `false`. Severity holds the display label, for example, `Critical`, so the condition ignores case.

### Add a Slack channel step

1. Click **+** to add another step.
2. Search for “Create Slack Channel” and select it.
3. Set the channel name to `inc-${inputs.data.incidentID}`.
4. Open the step’s menu, select **Open editor**, and set **Step ID** to `create_channel`.

Later steps use the step ID to read this step’s outputs. Step IDs need at least 5 characters. Use lowercase letters, digits, hyphens, or underscores, and start with a letter.

### Add a commander assignment step

1. Click **+** to add another step.
2. Search for “Add Participant to Incident” and select it.
3. Set the incident ID to `${inputs.data.incidentID}`.
4. Set the user ID to the email address of the person you want to assign as commander.
5. Set the role to `commander`.

### Add a notification step

1. Click **+** to add another step.
2. Search for “Post Message to Slack Channel” and select it.
3. Set the channel ID to `${steps.create_channel.outputs.channelID}` to post to the channel you just created.
4. Set the message text to:
   
   text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```text
   Incident ${inputs.data.incidentID}: ${resources.incident.event.title}
   Severity: ${resources.incident.event.severity}
   Commander assigned.
   ```

## Save and enable the workflow

You need to save and enable the workflow before you can run it.

1. Click **Save**. In the **Select a folder** dialog box, choose the folder for the workflow. Every workflow belongs to a folder, and the folder controls who can read and edit it. For details, refer to [Place a workflow in a folder](/docs/grafana-cloud/platform/workflows/create-workflows/#place-a-workflow-in-a-folder).
2. Turn on **Enable**.
3. Click **Save** again.

The workflow runs automatically when a critical incident is declared.

## Test the workflow

Run the workflow once with your test incident to check each step.

> Warning
> 
> The test creates a real Slack channel and assigns a real commander to the incident. Manual runs skip the trigger filter, so the filter step is the only check that runs. Use a critical incident, or the workflow stops at the filter step.

1. Click **Run** in the editor header.
2. In the **Trigger Workflow** dialog box, select an event in **Example Event** or replace the event with the following JSON. Replace *INCIDENT\_ID* with the ID of your test incident, then click **Trigger Workflow**.
   
   JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```json
   {
     "id": "example-message-id",
     "type": "grafana_irm_app.incident.updated",
     "source": "grafana_irm_app/100",
     "time": "2026-05-21T15:00:00Z",
     "data": {
       "incidentID": "<INCIDENT_ID>",
       "eventKind": "incident_created"
     }
   }
   ```
   
   Workflows expects an event in [CloudEvents](https://cloudevents.io/) shape. The fields under `data` become available in your steps as `inputs.data.*`. The other fields (`id`, `type`, `source`, `time`) describe the event itself. Workflows loads the incident with this ID from Grafana IRM, so the ID must belong to a real incident. For the fields a real incident event includes, refer to [Sample event payloads](/docs/grafana-cloud/platform/workflows/reference/event-payloads/#incident-events).
3. To see the results, click the arrow next to **Run** to open the **Latest runs** panel. Select the run to inspect each step’s inputs and outputs.

## View the workflow definition

Open the **More** menu in the editor header and select **View JSON** to view the complete workflow definition. The following YAML shows the equivalent definition for the workflow you built:

YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```yaml
apiVersion: workflows.ext.grafana.app/v1alpha1
kind: Definition
metadata:
  name: critical-incident-response
  annotations:
    grafana.app/folder: <FOLDER_UID>
spec:
  name: "Critical Incident Response"
  enabled: true
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\.updated"
        filter: "inputs.data.eventKind == 'incident_created'"
    schedules: []
  resources:
    incidents:
      event: "incident://id/${inputs.data.incidentID}"
  steps:
    - id: check-severity
      type: filter
      inputs:
        condition: "resources.incident.event.severity.matches('(?i)^critical$')"

    - id: create_channel
      type: slack.channel.create
      inputs:
        channelName: "inc-${inputs.data.incidentID}"

    - id: assign-commander
      type: incident.add-participant
      inputs:
        incidentID: "${inputs.data.incidentID}"
        userID: "commander@example.com"
        role: "commander"

    - id: post-summary
      type: slack.message.post
      inputs:
        channelID: "${steps.create_channel.outputs.channelID}"
        messageText: "Incident ${inputs.data.incidentID}: ${resources.incident.event.title}\nSeverity: ${resources.incident.event.severity}\nCommander assigned."
```

## Next steps

- [Use Blueprints](/docs/grafana-cloud/platform/workflows/use-blueprints)
- [Create workflows](/docs/grafana-cloud/platform/workflows/create-workflows)
- [Configure triggers](/docs/grafana-cloud/platform/workflows/configure-triggers)
- [Use CEL expressions](/docs/grafana-cloud/platform/workflows/use-expressions)
- [Sample event payloads](/docs/grafana-cloud/platform/workflows/reference/event-payloads)
- [Step and trigger types reference](/docs/grafana-cloud/platform/workflows/reference)