---
title: "Escalate severity changes | Grafana Cloud documentation"
description: "React to severity changes. Page leadership and alert the exec channel when an incident becomes Critical, and give a heads-up when one escalates to Major."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Escalate severity changes

> Note
> 
> Grafana Workflows is currently in [public preview](https://grafana.com/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

React to severity changes. Page leadership and alert the exec channel when an incident becomes Critical, and give a heads-up when one escalates to Major.

This Grafana Workflows blueprint is in the **Incidents** category of the Blueprints library.

## Before you begin

To use this blueprint, you need:

- Grafana IRM set up on your stack.
- Slack connected to Grafana IRM. For details, refer to [Configure Slack for Grafana IRM](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/integrations/chat-and-collaboration/slack/).

## Steps

Steps run in order from first to last. A step inside a switch branch runs only when Workflows chooses that branch.

Expand table

| Step                                                         | ID                  | Type                 | Description                                                                                                          |
|--------------------------------------------------------------|---------------------|----------------------|----------------------------------------------------------------------------------------------------------------------|
| Route by new severity                                        | `route-by-severity` | `switch`             | Picks a response based on the old and new severity. Edit the branch conditions to change which transitions escalate. |
| Page incident leadership (branch 1 of `route-by-severity`)   | `page-leadership`   | `irm.page-team`      | Pages your incident leadership team into the incident. Set `teamIdentifier` to the IRM team name.                    |
| Alert the exec channel (branch 1 of `route-by-severity`)     | `post-exec`         | `slack.message.post` | Posts to the channel leadership watches for critical incidents. Set `channelID`.                                     |
| Post a Major heads-up (branch 2 of `route-by-severity`)      | `post-major`        | `slack.message.post` | Posts a heads-up when an incident escalates to Major. Set `channelID`.                                               |
| No escalation needed (default branch of `route-by-severity`) | `no-escalation`     | `transform`          | Records that the change did not need an escalation. Shows up in the run details. No changes needed.                  |

For the inputs and outputs of each step type, refer to [Step and trigger types reference](https://grafana.com/docs/grafana-cloud/platform/workflows/reference/step-trigger-types).

Before you turn on the workflow, customize any steps that need input from you, such as a channel ID or a schedule name. Each step’s description says what to set.

## Workflow definition

Save this definition as a YAML file to create the workflow with gcx, the Workflows API, or Terraform, or give it to a coding agent as an example. Replace *FOLDER\_UID* with the UID of the folder for the workflow. Blueprints start disabled, so finish customizing the steps before you set `enabled` to `true`. For details, refer to [Manage workflows as code](https://grafana.com/docs/grafana-cloud/platform/workflows/as-code).

YAML ![Copy code to clipboard](https://grafana.com/media/images/icons/icon-copy-small-2.svg) Copy

```yaml
apiVersion: workflows.ext.grafana.app/v1alpha1
kind: Definition
metadata:
  name: escalate-severity-changes
  annotations:
    grafana.app/folder: <FOLDER_UID>
spec:
  name: Escalate severity changes
  enabled: false
  startWhen:
    matchingRules:
      - eventNameRegex: 'grafana_irm_app\.incident\.updated'
        filter: "inputs.data.eventKind == 'incident_updated_severity' && resources.incident.event.status == 'active'"
    schedules: []
  steps:
    - id: route-by-severity
      type: switch
      name: Route by new severity
      description: Picks a response based on the old and new severity. Edit the branch conditions to change which transitions escalate.
      branches:
        - condition: "inputs.data.newSeverity.matches('(?i)^critical$')"
          steps:
            - id: page-leadership
              type: irm.page-team
              name: Page incident leadership
              description: Pages your incident leadership team into the incident. Set teamIdentifier to the IRM team name.
              inputs:
                teamIdentifier: ''
                identifierType: 'name'
                incidentID: '${inputs.data.incidentID}'
                important: 'true'
                message: 'Incident "${resources.incident.event.title}" was raised from ${inputs.data.oldSeverity} to Critical.'
            - id: post-exec
              type: slack.message.post
              name: Alert the exec channel
              description: Posts to the channel leadership watches for critical incidents. Set channelID.
              inputs:
                channelID: ''
                messageText: ':red_circle: *Now Critical:* <${resources.incident.event.overviewURL}|${resources.incident.event.title}> (was ${inputs.data.oldSeverity})'
        - condition: "inputs.data.newSeverity.matches('(?i)^major$') && inputs.data.oldSeverity.matches('(?i)^(minor|pending)$')"
          steps:
            - id: post-major
              type: slack.message.post
              name: Post a Major heads-up
              description: Posts a heads-up when an incident escalates to Major. Set channelID.
              inputs:
                channelID: ''
                messageText: ':large_orange_circle: *Escalated to Major:* <${resources.incident.event.overviewURL}|${resources.incident.event.title}> (was ${inputs.data.oldSeverity})'
        - steps:
            - id: no-escalation
              type: transform
              name: No escalation needed
              description: Records that the change did not need an escalation. Shows up in the run details. No changes needed.
              inputs:
                template: 'No escalation for ${inputs.data.oldSeverity} → ${inputs.data.newSeverity}'
```

## How it works

This section explains when the workflow runs and how its steps work together.

### When it runs

This blueprint starts on the `grafana_irm_app.incident.updated` event.

Its trigger filter starts a run only when this CEL expression is true:

text ![Copy code to clipboard](https://grafana.com/media/images/icons/icon-copy-small-2.svg) Copy

```text
inputs.data.eventKind == 'incident_updated_severity' && resources.incident.event.status == 'active'
```

### How the steps fit together

These notes cover how the steps connect and which Workflows behaviors the blueprint relies on.

- Triggers on `eventKind` `incident_updated_severity`.
- The event carries the severity display labels as `inputs.data.newSeverity` and `inputs.data.oldSeverity`, for example Pending or Critical, so the switch compares them case-insensitively with `matches()`.
- The first branch whose condition is true runs.
- Critical pages the leadership team as important and posts to an exec channel.
- A rise to Major from Minor or Pending posts a heads-up.
- Every other change, including downgrades, falls through to the default branch, which only records the decision in the run output.
- This blueprint shows a switch with several conditioned branches and a default branch.
- Customize the leadership team name, the Slack channels, and which transitions count as escalations.

## Next steps

- [Blueprints](https://grafana.com/docs/grafana-cloud/platform/workflows/reference/blueprints)
- [Start from a blueprint](https://grafana.com/docs/grafana-cloud/platform/workflows/build/use-blueprints)
- [Manage workflows as code](https://grafana.com/docs/grafana-cloud/platform/workflows/as-code)
- [Step and trigger types reference](https://grafana.com/docs/grafana-cloud/platform/workflows/reference/step-trigger-types)