DOCS

Incident response & ChatOps

Run one incident lifecycle across the HowlOps dashboard, Slack, Telegram, Discord, Microsoft Teams, the CLI, and the REST API.

HowlOps keeps one incident record and one timeline across every supported response surface. A Slack acknowledgement, a dashboard action, and an API call do not create parallel states; they enter the same server-side lifecycle.

INCIDENT COMMAND · ONE SOURCE OF TRUTH

Respond where you already work.

Choose a surface to see the real incident actions available there. The interface changes; ownership, escalation, timeline, and resolution stay connected.

See the incident

Open the incident to see its source, severity, routing result, failure evidence, and live timeline.

alert → incident detail

Take ownership

Acknowledge to stop escalation, then assign or change the commander and resolver without losing context.

Acknowledge · Assign roles

Coordinate

Investigate telemetry or the source payload, move the lifecycle forward, add notes, and publish updates when needed.

Update · lifecycle · war room

Resolve and learn

Resolve through the canonical close flow, notify the same response path, and continue into the recorded postmortem.

Resolve · Postmortem

Interactive providers share one incident lifecycle. Incoming-webhook-only integrations remain action cards or notification-only by provider capability. Open the incident response guide

The four actions to understand

Action	What it does	What it does not do
Acknowledge	Marks the incident as owned and stops escalation from advancing.	It does not resolve the failure.
Silence	Pauses incident escalation and the responder's notification chain for a bounded time.	It does not close or hide the incident.
Update	Adds internal context or publishes a customer-facing status update.	It does not change monitor health by itself.
Resolve	Runs the terminal close flow, stops escalation, records the action, and sends the resolution lifecycle event.	It should not be used merely to reduce notification noise; use Silence for that.

Removing an acknowledgement re-arms escalation and the personal notification chain. Use it when ownership was released or the acknowledgement was accidental.

Recommended response, step by step

Open the newest incident. In Slack, run /howlops status to list recent open incidents with their full IDs. In HowlOps, open Incidents.
Acknowledge first. This gives the team a clear owner and stops the next escalation step.
Set command roles when coordination is needed. Assign a commander and resolver in the dashboard. For a major incident, open the war room card. Slack OAuth can create the channel from the configured naming pattern; other providers accept an existing channel and video-bridge link.
Diagnose from recorded evidence. Use monitor telemetry and check details for native monitoring incidents. For external alerts, use the source payload and link; HowlOps does not invent a time series that the source did not send.
Keep one running narrative. Put team-only detail in internal notes. Use a public update only when it should reach the connected status page and its subscribers.
Resolve when the incident is actually over. Add an optional explanation after closing, then review the timeline and continue into the postmortem.

Slack commands

The official Slack OAuth integration supports these commands:

/howlops status
/howlops ack <incident_id>
/howlops silence <incident_id> [minutes]
/howlops resolve <incident_id>
/howlops help

silence defaults to 60 minutes and accepts a whole number from 1 to 1440. The command response appears immediately; database work completes through Slack's asynchronous response channel so a slow dependency does not exceed Slack's three-second acknowledgement window.

A manually configured Slack Incoming Webhook can receive alerts and recoveries, but it cannot authenticate interactive incident actions or slash commands. Use Add to Slack (OAuth) for ChatOps.

Slack incident channels

Under Incident settings, enable Auto-create chat channel after connecting Slack with OAuth. When a war room is opened with its channel field blank, HowlOps calls Slack's Conversations API and stores the returned channel link on the incident.

An org-wide incident creates a public channel.
An incident owned by a private HowlOps team creates a private channel and invites the user who installed the Slack connection.
HowlOps does not guess Slack usernames. Inviting every assigned responder needs a stable Slack-to-HowlOps identity link for each responder; until that exists, add the remaining responders in Slack.

Telegram commands

After pairing the bot from HowlOps, Telegram supports the same core response loop:

/status
/oncall
/ack <incident_id>
/silence <incident_id> [minutes]
/resolve <incident_id>
/whoami
/help

Pairing binds the stable Telegram user ID to the HowlOps user who created the connection. A group member who has not paired an identity can see messages already visible in that group, but cannot use them to change an incident.

Discord application commands

When the HowlOps application commands are registered in Discord, the howlops command supports status, oncall, ack, silence, and resolve. Incident messages expose the same Acknowledge, Silence 1h, and Resolve buttons.

Discord verifies every interaction signature. HowlOps then resolves the stable guild, channel, and user IDs captured during OAuth before applying incident permissions and private-team visibility.

Surface boundaries

Surface	Available response actions	Important boundary
HowlOps dashboard	Acknowledge, unacknowledge, silence, assign roles, merge, update, resolve, postmortem	Full incident command surface.
Slack OAuth app	Status, acknowledge, silence, resolve; message buttons; incident-channel creation	Commands require the stable Slack installation identity. Legacy installations must reconnect.
Telegram bot	Status, on-call, acknowledge, silence, resolve; message buttons	The sender must match the Telegram user captured during pairing.
Discord app	Status, on-call, acknowledge, silence, resolve; message buttons	Commands must be registered in Discord; the signed guild/channel/user tuple is re-authorized by HowlOps.
Slack Incoming Webhook	Alert and recovery delivery	Notification-only.
Mattermost incoming webhook	Acknowledge, silence, resolve buttons	The signed action is bound to the exact HowlOps notification channel and its team scope.
Microsoft Teams Workflow	Acknowledge, silence, resolve links	Each scoped link opens a signed browser confirmation because a plain Workflow webhook cannot run bot commands or mutate the card in place.
`hwl` CLI	Acknowledge, snooze, resolve	Designed for ad-hoc actions; use the REST API for richer automation.
REST API / MCP	Authenticated incident operations	Permissions and team visibility are still enforced for user/API contexts.

“Same lifecycle” does not mean every provider exposes the same interface. Slack, Telegram, and Discord can receive commands. Mattermost and Teams Workflow connections expose scoped actions on incident cards. Providers that only accept outgoing webhooks remain notification-only.

Set up a response surface

Was this page helpful?