Incidents in Slack

The Komodor Agentic Operation Platform (KAOP) runs incident workflows from Slack. You start an incident by mentioning KAOP’s Slack app, follow and steer it in the same thread, and ask about it there once it is done. Nothing has to be set up in the channel. What you do from Slack (starting, stopping, pressing a button, asking) is checked against your own KAOP permissions; the investigation itself runs with the workflow’s own agents.

​

Before you start

• Slack is connected to your KAOP account, through KAOP’s Slack app or your own Slack app connected for chat. Both work the same way. See Connecting Slack. If you connected your own Slack app for chat, mention that app wherever this page says KAOP’s Slack app.
• The app is in the channel.
• At least one incident workflow is active. See Incident management & troubleshooting.
• Your Slack account is linked to your KAOP user. The first time you start, stop or ask about an incident, KAOP replies with a connect prompt that only you can see. That request is not kept: once you have linked, mention the app again. A Stop pressed before you linked can stay on Stopping…, so stop the incident from its incident page instead. Slack Connect guests from another organization cannot act on incidents.

Each action needs a KAOP permission, checked as you: Roles and custom grants are described in Roles & permissions.

​

Start an incident

KAOP picks the workflow in this order:

1. The only workflow you can start.
2. Under an alert, the workflow whose alert source is the app that posted it.
3. The workflow last started in this channel.

If none applies, the dropdown starts empty and you choose.

​

Starting under an alert

An incident started under an alert takes the alert’s title, severity and labels, so a workflow’s filter on those fields sees what the alert says. Labels are the alert’s key:value tokens, such as env:prod. Your own words become the incident’s description.

​

When KAOP does not start a new incident

​

Follow it in the thread

The incident reports in the thread you started it from, with one short reply at each milestone: when it starts, when it finds a likely cause, when the agent has a question, when a fix is applied, and when it ends. If an agent’s tool call needs approval, its approval card is posted in the thread as well. An incident opened by an alert routed to a workflow reports in the alert’s thread the same way. The reaction on your message shows where it stands, one at a time: 👀 picked up, ⏳ working, ✅ resolved, ❌ failed or stopped, 🟡 needs review. Slack’s own status under the thread shows KAOP working while the investigation runs, with Slack’s Stop button beside it. It clears while the incident waits for a person and when it ends. If the workflow also notifies a Slack channel, that channel gets the full summary when the workflow reaches its conclusion. When it is the channel the incident was started in, the conclusion is posted once, in the thread. A resolve by a person, from the thread, the incident page or the co-pilot, reaches the incident’s thread only, not the workflow’s notification channel.

​

Continue, Resolve and Retry

Continue picks the investigation up from the step that stopped, Retry starts a workflow that failed to start again, and Resolve closes the incident. A button acts as the person who presses it: it needs a linked Slack account and permission to manage incidents, and anyone else gets a private refusal. Once pressed, the buttons give way to Continued by, Retried by or Resolved by and the person’s name. If two people press at once, only one press goes through. Every press is recorded in the audit log under the person’s name.

​

Stop it

While KAOP is working, press Slack’s Stop button under the thread. KAOP stops the running step and posts ⏹️ Stopped by you, with Continue and Resolve, so the incident can pick up again later. The incident’s timeline records who asked to stop it. Anyone with permission to manage incidents can stop one, not only the person who started it. Only the person who pressed Stop sees these replies:

​

Ask about it

Mention KAOP’s Slack app with your question in the incident’s thread, for example what was the likely cause?. The answer is posted in the thread and comes from that incident: its alert, findings and runs, and the incident’s chat. It ends with From incident and the incident’s name, linked, beside a link to the run that answered. Asking never changes the incident’s findings or status. The question runs as you, so you need a linked Slack account and permission to view incidents and use chat. If the answer needs a tool call approved, the approval card appears in the thread. A reply in the thread that does not mention the app gets no answer. Slack and the incident page share one conversation. A question asked in Slack shows in the incident’s Ask about this incident card, labelled with the asker’s name and via Slack (yours reads You · via Slack), and in Chat. A question asked on the incident page is not posted to Slack. The answer in Slack is public to the channel and can draw on the whole incident chat, including questions asked on the page.

​

Next steps