Documentation Grafana Cloud Platform Workflows Get started

Get started with Grafana Workflows

This guide walks you through creating your first workflow in Grafana Workflows. You’ll build an incident response automation that runs when a critical incident is declared, creates a Slack channel, assigns a commander, and posts a summary.

Before you begin

To complete this guide, you need:

• The Editor basic role and workflows:write. For details, refer to Manage access.
• A Grafana folder you can edit. Every workflow is saved in a folder, and you can’t save one until a folder exists.
• Grafana IRM with Slack connected. For details, refer to Configure Slack for Grafana IRM.
• The email address of the person you want to assign as commander.
• A critical incident to test with. A drill incident works.

Create a workflow

1. In Grafana Cloud, open the Workflows app.
2. Go to Manage workflows and click New workflow.
3. In the Create workflow dialog box, click Start from scratch.
4. Click the workflow title and enter a name, for example, “Critical Incident Response”.

Choose a trigger

The trigger decides when your workflow runs. For this example, the workflow runs when an incident is declared. IRM sends an Incident Updated event for every change to an incident, so a filter on the trigger keeps only the event IRM sends when an incident is declared.

1. Click the trigger node, select Event, then select Incident Updated.

2. In the Filter field, enter:

   text Copy

   inputs.data.eventKind == 'incident_created'

Load the incident

An incident event carries the incident ID and a description of what changed, but not the full incident. Fields such as the title and severity come from the incident itself, which Workflows loads as resources.incident.event. Workflows loads it for you when an IRM event starts the workflow, but not when you start a run with Run. Declare the incident so it loads in both cases.

1. Open the More menu in the editor header and select Settings.
2. Select the Resources tab and click Add Resource.
3. Set the type to Incident, the name to event, and the URI to incident://id/${inputs.data.incidentID}.

Add a filter step

To respond only to critical incidents, add a filter step.

1. Click + on the last node in the workflow tree.

2. Search for “Filter” in the action palette and select it.

3. In Condition, enter:

   text Copy

   resources.incident.event.severity.matches('(?i)^critical$')

   The workflow stops if the condition evaluates to false. Severity holds the display label, for example, Critical, so the condition ignores case.

Add a Slack channel step

1. Click + to add another step.
2. Search for “Create Slack Channel” and select it.
3. Set the channel name to inc-${inputs.data.incidentID}.
4. Open the step’s menu, select Open editor, and set Step ID to create_channel.

Later steps use the step ID to read this step’s outputs. Step IDs need at least 5 characters. Use lowercase letters, digits, hyphens, or underscores, and start with a letter.

Add a commander assignment step

1. Click + to add another step.
2. Search for “Add Participant to Incident” and select it.
3. Set the incident ID to ${inputs.data.incidentID}.
4. Set the user ID to the email address of the person you want to assign as commander.
5. Set the role to commander.

Add a notification step

1. Click + to add another step.

2. Search for “Post Message to Slack Channel” and select it.

3. Set the channel ID to ${steps.create_channel.outputs.channelID} to post to the channel you just created.

4. Set the message text to:

   text Copy

   Incident ${inputs.data.incidentID}: ${resources.incident.event.title}
   Severity: ${resources.incident.event.severity}
   Commander assigned.

Save and enable the workflow

You need to save and enable the workflow before you can run it.

1. Click Save. In the Select a folder dialog box, choose the folder for the workflow. Every workflow belongs to a folder, and the folder controls who can read and edit it. For details, refer to Place a workflow in a folder.
2. Turn on Enable.
3. Click Save again.

The workflow runs automatically when a critical incident is declared.

Test the workflow

Run the workflow once with your test incident to check each step.

1. Click Run in the editor header.

2. In the Trigger Workflow dialog box, select an event in Example Event or replace the event with the following JSON. Replace INCIDENT_ID with the ID of your test incident, then click Trigger Workflow.

   JSON Copy

   {
     "id": "example-message-id",
     "type": "grafana_irm_app.incident.updated",
     "source": "grafana_irm_app/100",
     "time": "2026-05-21T15:00:00Z",
     "data": {
       "incidentID": "<INCIDENT_ID>",
       "eventKind": "incident_created"
     }
   }

   Workflows expects an event in CloudEvents shape. The fields under data become available in your steps as inputs.data.*. The other fields (id, type, source, time) describe the event itself. Workflows loads the incident with this ID from Grafana IRM, so the ID must belong to a real incident. For the fields a real incident event includes, refer to Sample event payloads.

3. To see the results, click the arrow next to Run to open the Latest runs panel. Select the run to inspect each step’s inputs and outputs.

View the workflow definition

Open the More menu in the editor header and select View JSON to view the complete workflow definition. The following YAML shows the equivalent definition for the workflow you built:

YAML Copy

apiVersion: workflows.ext.grafana.app/v1alpha1
kind: Definition
metadata:
  name: critical-incident-response
  annotations:
    grafana.app/folder: <FOLDER_UID>
spec:
  name: "Critical Incident Response"
  enabled: true
  startWhen:
    matchingRules:
      - eventNameRegex: "grafana_irm_app\\.incident\\.updated"
        filter: "inputs.data.eventKind == 'incident_created'"
    schedules: []
  resources:
    incidents:
      event: "incident://id/${inputs.data.incidentID}"
  steps:
    - id: check-severity
      type: filter
      inputs:
        condition: "resources.incident.event.severity.matches('(?i)^critical$')"

    - id: create_channel
      type: slack.channel.create
      inputs:
        channelName: "inc-${inputs.data.incidentID}"

    - id: assign-commander
      type: incident.add-participant
      inputs:
        incidentID: "${inputs.data.incidentID}"
        userID: "commander@example.com"
        role: "commander"

    - id: post-summary
      type: slack.message.post
      inputs:
        channelID: "${steps.create_channel.outputs.channelID}"
        messageText: "Incident ${inputs.data.incidentID}: ${resources.incident.event.title}\nSeverity: ${resources.incident.event.severity}\nCommander assigned."

Next steps

• Use Blueprints
• Create workflows
• Configure triggers
• Use CEL expressions
• Sample event payloads
• Step and trigger types reference