Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Platformbreadcrumb arrow Workflowsbreadcrumb arrow Referencebreadcrumb arrow Blueprintsbreadcrumb arrow Escalate severity changes
Public preview Grafana Cloud
Last reviewed: November 9, 2026

Escalate severity changes

Note

Grafana Workflows is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

React to severity changes. Page leadership and alert the exec channel when an incident becomes Critical, and give a heads-up when one escalates to Major.

This Grafana Workflows blueprint is in the Incidents category of the Blueprints library.

Before you begin

To use this blueprint, you need:

Steps

Steps run in order from first to last. A step inside a switch branch runs only when Workflows chooses that branch.

StepIDTypeDescription
Route by new severityroute-by-severityswitchPicks a response based on the old and new severity. Edit the branch conditions to change which transitions escalate.
Page incident leadership (branch 1 of route-by-severity)page-leadershipirm.page-teamPages your incident leadership team into the incident. Set teamIdentifier to the IRM team name.
Alert the exec channel (branch 1 of route-by-severity)post-execslack.message.postPosts to the channel leadership watches for critical incidents. Set channelID.
Post a Major heads-up (branch 2 of route-by-severity)post-majorslack.message.postPosts a heads-up when an incident escalates to Major. Set channelID.
No escalation needed (default branch of route-by-severity)no-escalationtransformRecords that the change did not need an escalation. Shows up in the run details. No changes needed.

For the inputs and outputs of each step type, refer to Step and trigger types reference.

Before you turn on the workflow, customize any steps that need input from you, such as a channel ID or a schedule name. Each step’s description says what to set.

Workflow definition

Save this definition as a YAML file to create the workflow with gcx, the Workflows API, or Terraform, or give it to a coding agent as an example. Replace FOLDER_UID with the UID of the folder for the workflow. Blueprints start disabled, so finish customizing the steps before you set enabled to true. For details, refer to Manage workflows as code.

YAML 
apiVersion: workflows.ext.grafana.app/v1alpha1
kind: Definition
metadata:
  name: escalate-severity-changes
  annotations:
    grafana.app/folder: <FOLDER_UID>
spec:
  name: Escalate severity changes
  enabled: false
  startWhen:
    matchingRules:
      - eventNameRegex: 'grafana_irm_app\.incident\.updated'
        filter: "inputs.data.eventKind == 'incident_updated_severity' && resources.incident.event.status == 'active'"
    schedules: []
  steps:
    - id: route-by-severity
      type: switch
      name: Route by new severity
      description: Picks a response based on the old and new severity. Edit the branch conditions to change which transitions escalate.
      branches:
        - condition: "inputs.data.newSeverity.matches('(?i)^critical$')"
          steps:
            - id: page-leadership
              type: irm.page-team
              name: Page incident leadership
              description: Pages your incident leadership team into the incident. Set teamIdentifier to the IRM team name.
              inputs:
                teamIdentifier: ''
                identifierType: 'name'
                incidentID: '${inputs.data.incidentID}'
                important: 'true'
                message: 'Incident "${resources.incident.event.title}" was raised from ${inputs.data.oldSeverity} to Critical.'
            - id: post-exec
              type: slack.message.post
              name: Alert the exec channel
              description: Posts to the channel leadership watches for critical incidents. Set channelID.
              inputs:
                channelID: ''
                messageText: ':red_circle: *Now Critical:* <${resources.incident.event.overviewURL}|${resources.incident.event.title}> (was ${inputs.data.oldSeverity})'
        - condition: "inputs.data.newSeverity.matches('(?i)^major$') && inputs.data.oldSeverity.matches('(?i)^(minor|pending)$')"
          steps:
            - id: post-major
              type: slack.message.post
              name: Post a Major heads-up
              description: Posts a heads-up when an incident escalates to Major. Set channelID.
              inputs:
                channelID: ''
                messageText: ':large_orange_circle: *Escalated to Major:* <${resources.incident.event.overviewURL}|${resources.incident.event.title}> (was ${inputs.data.oldSeverity})'
        - steps:
            - id: no-escalation
              type: transform
              name: No escalation needed
              description: Records that the change did not need an escalation. Shows up in the run details. No changes needed.
              inputs:
                template: 'No escalation for ${inputs.data.oldSeverity} → ${inputs.data.newSeverity}'

How it works

This section explains when the workflow runs and how its steps work together.

When it runs

This blueprint starts on the grafana_irm_app.incident.updated event.

Its trigger filter starts a run only when this CEL expression is true:

text 
inputs.data.eventKind == 'incident_updated_severity' && resources.incident.event.status == 'active'

How the steps fit together

These notes cover how the steps connect and which Workflows behaviors the blueprint relies on.

  • Triggers on eventKind incident_updated_severity.
  • The event carries the severity display labels as inputs.data.newSeverity and inputs.data.oldSeverity, for example Pending or Critical, so the switch compares them case-insensitively with matches().
  • The first branch whose condition is true runs.
  • Critical pages the leadership team as important and posts to an exec channel.
  • A rise to Major from Minor or Pending posts a heads-up.
  • Every other change, including downgrades, falls through to the default branch, which only records the decision in the run output.
  • This blueprint shows a switch with several conditioned branches and a default branch.
  • Customize the leadership team name, the Slack channels, and which transitions count as escalations.

Next steps