Skip to content
1stLine Docs 1stLine Docs

Incident Actions

Incident Actions let 1stLine by Burava run follow-up actions when incident lifecycle events happen.

Open Incidents, then open the Incident Actions tab.

What Incident Actions do

An Incident Action is an org-level rule that runs when a chosen incident event happens.

The current action types are:

  • Note
  • Webhook

This is useful when the team wants incident changes to create a note, notify another system, or trigger a workflow outside the incident itself.

Trigger events

Incident Actions can run from these trigger events:

  • created
  • resolved
  • closed
  • reopened
  • priority_changed
  • postmortem_updated

Choose the trigger based on the exact moment you want the action to run.

Examples:

  • use created to notify a downstream system that a new incident began
  • use priority_changed to notify only when urgency changes
  • use postmortem_updated to react when the postmortem is updated

Action scope

An Incident Action can apply to:

  • Any schema
  • one specific schema

Use schema scope when one incident workflow should only run for incidents built from a particular incident schema.

Conditions

Incident Actions use the same general condition model used elsewhere in 1stLine:

  • Field
  • Operator
  • Value
  • Is not
  • Is Priority

They also use Respect Conditions to decide whether the rule requires all conditions or any condition.

Use conditions when an action should only run for certain incident states, priorities, or fields.

Note actions

Use Note when the action should create a message from the incident lifecycle event.

The editor uses Message template for this action type.

This is the simplest Incident Action type when the team wants a formatted note based on incident data.

Webhook actions

Use Webhook when the action should call an external HTTPS endpoint.

The editor includes:

  • Webhook URL
  • Method
  • Headers
  • JSON template

Use this when another system should receive the incident event as structured JSON.

Templates

Incident Actions support templates based on the incident event context.

Useful values include:

  • incident.title
  • incident.description
  • incident.status
  • incident.priority
  • incident.link
  • event.type
  • event.actor_email
  • event.actor_name

Example note template:

Incident ${incident.title} changed on ${event.type}

Example JSON template:

{
  "title": "${incident.title}",
  "priority": "${incident.priority}",
  "event": "${event.type}"
}

How to verify Incident Actions

After creating or changing an Incident Action:

  1. trigger the matching incident event
  2. open the incident details page
  3. open History
  4. confirm the action execution appears there

If the action did not run, check the trigger event, schema scope, and conditions first.