Memory of an incident degrades within a day
Hours after an incident, everyone involved remembers the events in a different order, and every version is sincere. The alert, the first message, the deploy that was rolled back, the moment someone noticed: reconstructing that from memory a week later produces a story rather than a record.
The records exist. Alerts have timestamps. Messages have timestamps. Deploys have timestamps. The sequence assembles itself once someone collects all three.
Impact is the other half and gets estimated where it could be measured: how long, how many requests, which customers, and which of them noticed.
Assembling this is clerical work that delays the review and often replaces it. The flow handles the clerical half. The review does what only people can: decide what it means and what changes are needed.
How the ActionFlow runs on the canvas
Once the incident is closed, incident records are read on a Manual trigger. This flow assembles a review. It does not take part in the response.
An HTTP Request node collects alerts and deploy records. A Slack node reads the incident channel. A GitHub node reads what merged during the window.
A Merge node combines them into one series. A Sort node orders it by timestamp, which is the moment the sequence stops being contested.
A Generate Object node returns the timeline, with each entry containing its source record and the relevant intervals: detection, acknowledgment, and mitigation.
A Math node computes duration and impact figures from the supplied data and leaves anything it was not given blank rather than estimating it.
A Generate Text node writes the impact and timeline sections to your review template and stops before the cause section. The draft states what happened, never why.
A Google Docs node holds it for the review. A Notion node files it against the service. A Human in the Loop node puts the incident lead between the draft and the meeting invitation.
Nodes this ActionFlow uses
- Manual (Triggers): runs after the incident closes, never during it.
- HTTP Request (Util): alerts and deploy records with their timestamps.
- Slack (Communication): reads the incident channel for the human sequence.
- Merge (Control) with Sort (Data): one series, ordered by time.
- Generate Object (AI Core): the timeline, each entry carrying its source record.
- Math (Util): duration and impact from supplied data. Blanks stay blank.
- Google Docs (Integration): the draft the review works from.
- Notion (Integration): files the review against the service.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.