Creating Incidents via Slack Interface

A step-by-step guide to creating incidents directly from Slack, including message-based creation, customizable fields, private incident handling, and automated channel creation.

Overview

Slack is one of the fastest and most natural places to declare an incident. Whether a responder notices an issue in conversation, spots a customer report, or sees a monitoring message posted into a channel, Rootly’s Slack integration lets you create an incident instantly — directly from where your team already works.

Use Slack when you need speed, context, and collaboration without switching tools.

Slack-based creation supports:

• Customizable incident fields
• Required-field validation
• Private incident creation
• Automated Slack channel creation
• Full integration with workflows and lifecycle updates

Need help installing the Rootly Slack app? See the Slack Integration Guide.

Create a New Incident in Slack

1. Method 1 — Use a Slash Command

   1. Type:

      /rootly new
      
      

      in any Slack channel.

   2. Press Enter to open the New Incident form.

   This is the fastest way to start a new incident manually.

   Method 2 — Create an Incident From a Slack Message

   Use this when the trigger is a message, alert, screenshot, or customer report already posted in Slack.

   1. Hover over the message
   2. Click More actions (three dots)
   3. Select Create an incident

   The New Incident form will open pre-filled with a link to the original message, giving responders immediate context.

   Message-based creation provides the clearest starting point for responders and is ideal for customer complaints, noisy alerts, or discussions that evolve into incidents.

2. Fill In the Incident Details

   The New Incident form appears as a Slack modal and includes the essential fields needed to start coordinated response.

   Most fields are customizable in Configuration → Forms.

   

   Default Fields

   Field	Description
   Title	Title of the incident; also used to name the Slack incident channel.
   Summary	A concise description of the issue.
   Severity	Default levels SEV3 → SEV0.
   Type	Default categories: Cloud, Security, Customer-Facing, Default.
   Mark as Private	Restricts visibility to permitted users.

   Additional Notes

   • Required fields are marked with a *
   • Leaving Title blank triggers the Automatic Incident Title Generator
   • Only privileged users can create or access Private incidents
   • Private mode is ideal for sensitive or security-related issues

   If your team uses Mark as In Triage, selecting it will start the incident in Triage instead of Started. See Incident Lifecycle for details.

3. Create the Incident

   Click Create.

   Rootly will immediately:

   • Create a dedicated Slack incident channel
   • Post the initial system message
   • Log the creation event in the Timeline
   • Trigger any configured workflows
     • Role assignment
     • Stakeholder notifications
     • Ticket creation
     • Checklists
     • Channel topic updates

   

   Most teams automate channel setup, role assignments, and initial communication, so responders can focus on investigation — not coordination.

After the Incident Is Created

The Slack incident channel becomes your command center. From here you can:

• Update lifecycle status with /rootly status
• Resolve or cancel with /rootly resolve or /rootly cancel
• Add timeline events
• Modify fields using /rootly edit
• Run workflows using /rootly workflow
• Generate an AI summary using /rootly summary
• Invite responders and collaborate in real time

All changes sync automatically with the Rootly Web UI and appear in the Timeline.

Customizing the Slack Incident Form

Your Slack form can be fully tailored to match your Web UI form.

1. Open Form Configuration

   To customize:

   1. Go to Configuration → Forms
   2. Under Default Forms, click Configure on New Incident
   3. Select the Slack tab
   4. (Optional) Click Copy fields from Web form

   The editor shows:

   • Left side → the form structure

   • Right side → real-time preview

     
2. Edit and Manage Fields

   You can customize:

   • Field order
   • Field visibility
   • Required fields
   • Custom field types (dropdowns, multi-selects, relations, etc.)

   Controls:

   • Drag handle → reorder
   • Pencil icon → edit
   • Minus icon → remove
   • Add Fields → add new fields

   Changes save automatically.

   We recommend keeping Slack and Web forms aligned. This ensures responders have a consistent experience no matter where incidents originate.

Troubleshooting

“Commands aren’t working.”

Make sure you’re inside a Rootly incident channel, not a normal channel.

“I can't create or view a Private Incident.”

You need the correct permissions (owner/admin/private-incident access).

“/rootly mitigate doesn’t work.”

Your workspace likely uses sub-statuses, which disable the mitigate command.
Use /rootly status instead.

“The form won’t let me create the incident.”

Your workspace may enforce:

• Required fields
• Conditional fields
• Required lifecycle metadata

Check for missing fields marked with *.

“The Slack incident channel didn’t get created.”

Check:

• Slack integration is connected
• Auto-create channels is enabled
• Private incident behavior matches workspace rules

Best Practices

• Prefer message-based creation for rich context
• Keep fields minimal but meaningful
• Use Private mode for sensitive incidents
• Train responders to use /rootly status for lifecycle updates
• Align Slack + Web forms for consistency
• Automate repetitive tasks (channel setup, assignments, notifications)

High-quality incident creation through Slack accelerates response, reduces confusion, and keeps everyone aligned from the very first minute.