Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Platformbreadcrumb arrow Workflowsbreadcrumb arrow Referencebreadcrumb arrow Blueprintsbreadcrumb arrow Draft post-incident review
Public preview Grafana Cloud
Last reviewed: November 9, 2026

Draft post-incident review

Note

Grafana Workflows is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

When a critical or major incident is resolved, Grafana Assistant drafts a post-incident review as a Grafana Notebook, then shares an executive summary and the notebook link on the incident timeline and in Slack.

This Grafana Workflows blueprint is in the Incidents category of the Blueprints library.

Before you begin

To use this blueprint, you need:

  • Grafana IRM set up on your stack.
  • Slack connected to Grafana IRM. For details, refer to Configure Slack for Grafana IRM.
  • Grafana Assistant in use on your stack.

Steps

Steps run in order from first to last. A step inside a switch branch runs only when Workflows chooses that branch.

StepIDTypeDescription
Draft the review as a notebookdraftassistant.promptAsks Grafana Assistant to write the review as a Grafana Notebook and return an executive summary with the notebook link. Edit the notebook sections in the prompt to match your post-incident review template.
Add the summary to the timelineadd-summary-noteincident.add-notePosts the executive summary and the notebook link as a timeline note. No changes needed.
Has an incident channel?has-slack-channelfilterStops here when the incident has no linked Slack channel. No changes needed.
Share the summary in Slackshare-summaryslack.message.postPosts the executive summary and the notebook link to the incident channel. No changes needed.

For the inputs and outputs of each step type, refer to Step and trigger types reference.

Before you turn on the workflow, customize any steps that need input from you, such as a channel ID or a schedule name. Each step’s description says what to set.

Workflow definition

Save this definition as a YAML file to create the workflow with gcx, the Workflows API, or Terraform, or give it to a coding agent as an example. Replace FOLDER_UID with the UID of the folder for the workflow. Blueprints start disabled, so finish customizing the steps before you set enabled to true. For details, refer to Manage workflows as code.

YAML 
apiVersion: workflows.ext.grafana.app/v1alpha1
kind: Definition
metadata:
  name: draft-post-incident-review
  annotations:
    grafana.app/folder: <FOLDER_UID>
spec:
  name: Draft post-incident review
  enabled: false
  runOnceFor: 'pir-draft:${inputs.data.incidentID}'
  startWhen:
    matchingRules:
      - eventNameRegex: 'grafana_irm_app\.incident\.updated'
        filter: "inputs.data.eventKind == 'incident_updated_status' && inputs.data.newStatus == 'resolved' && resources.incident.event.severity.matches('(?i)^(critical|major)$') && !resources.incident.event.isDrill"
    schedules: []
  steps:
    - id: draft
      type: assistant.prompt
      name: Draft the review as a notebook
      description: >-
        Asks Grafana Assistant to write the review as a Grafana Notebook and return an executive
        summary with the notebook link. Edit the notebook sections in the prompt to match your
        post-incident review template.
      inputs:
        prompt: |
          Draft a blameless post-incident review for Grafana IRM incident ${inputs.data.incidentID}: "${resources.incident.event.title}".

          Severity: ${resources.incident.event.severity}
          Started: ${resources.incident.event.incidentStart}
          Resolved: ${resources.incident.event.closedTime}
          Summary so far: ${resources.incident.event.summary}
          Incident page: ${resources.incident.event.overviewURL}

          Investigate using the incident timeline, key updates, related alert groups, and telemetry from the incident window.
          Separate facts you verified from hypotheses. Do not assign blame to individuals.

          Create one new Grafana Notebook titled "Post-incident review: ${resources.incident.event.title}" that holds the full review, with these sections:
          - Summary: what happened, in two or three sentences
          - Impact: who or what was affected, and for how long
          - Timeline: the key moments, oldest first
          - Contributing factors: what made this happen or made it worse
          - Action items: concrete follow-ups, each starting with a verb
          Add panels for the key metrics or logs around the incident window where they help explain what happened.
          Create the notebook once. Do not create a second notebook to fix your response.

          Return:
          - executiveSummary: two or three sentences for leadership covering what happened, the impact, and the most important follow-up
          - notebookUrl: the absolute URL of the notebook you created. Use the same Grafana host as the incident page above, for example https://<host>/notebooks/<uid>
        outputSchema: |
          {
            "type": "object",
            "required": ["executiveSummary", "notebookUrl"],
            "properties": {
              "executiveSummary": { "type": "string" },
              "notebookUrl": { "type": "string", "pattern": "^https://.+/notebooks/.+" }
            }
          }
        maxRetries: '3'
    - id: add-summary-note
      type: incident.add-note
      name: Add the summary to the timeline
      description: Posts the executive summary and the notebook link as a timeline note. No changes needed.
      inputs:
        incidentID: '${inputs.data.incidentID}'
        message: |
          **Post-incident review draft (generated by Grafana Assistant, please review)**

          ${steps.draft.outputs.result.executiveSummary}

          [Read the full review in Grafana Notebooks](${steps.draft.outputs.result.notebookUrl})
    - id: has-slack-channel
      type: filter
      name: Has an incident channel?
      description: Stops here when the incident has no linked Slack channel. No changes needed.
      inputs:
        condition: "has(resources.incident.event.slackChannelID)"
    - id: share-summary
      type: slack.message.post
      name: Share the summary in Slack
      description: Posts the executive summary and the notebook link to the incident channel. No changes needed.
      inputs:
        channelID: '${resources.incident.event.slackChannelID}'
        messageText: |
          :scroll: *Post-incident review draft is ready*
          ${steps.draft.outputs.result.executiveSummary}

          <${steps.draft.outputs.result.notebookUrl}|Read the full review in Grafana Notebooks>

How it works

This section explains when the workflow runs and how its steps work together.

When it runs

This blueprint starts on the grafana_irm_app.incident.updated event.

Its trigger filter starts a run only when this CEL expression is true:

text 
inputs.data.eventKind == 'incident_updated_status' && inputs.data.newStatus == 'resolved' && resources.incident.event.severity.matches('(?i)^(critical|major)$') && !resources.incident.event.isDrill

It runs at most once for each run-once key. This blueprint’s key is pir-draft:${inputs.data.incidentID}, so a later event with the same key doesn’t start another run. For details, refer to Deduplicate workflow runs.

How the steps fit together

These notes cover how the steps connect and which Workflows behaviors the blueprint relies on.

  • Triggers on eventKind incident_updated_status when newStatus is resolved, filtered in the trigger to Critical and Major incidents that are not drills.
  • runOnceFor keys on the incident ID alone, so an incident gets one draft even if it is reopened and resolved again.
  • Because the filtering happens in the trigger filter, non-matching events release the key.
  • The assistant.prompt step asks Grafana Assistant to investigate the incident (timeline, key updates, alert groups, and telemetry around the incident window), write the full review into a new Grafana Notebook, and return JSON that matches outputSchema: an executive summary and the notebook’s absolute URL.
  • The schema requires the URL to start with https and contain /notebooks/, so a missing or relative link fails validation and the assistant retries.
  • The prompt gives the incident page URL so the assistant can build the absolute notebook URL from the same Grafana host.
  • The timeline note and the Slack message both read steps.draft.outputs.result.
  • Customize the severity filter, the review sections in the prompt, and the notebook contents.

Next steps