Incidents
How do I create an incident from Slack?
Type/rootly new in any Slack channel to open the New Incident form, or hover over an existing message, click More actions (three dots), and select Create an incident to declare an incident from a message, alert, or customer report. You can also mention @Rootly and ask the AI agent to create the incident for you in plain language. Slack-based creation supports customizable fields, required-field validation, private incidents, and automatic incident channel creation. Learn more: Creating Incidents via Slack.
What’s the difference between severity and priority in Rootly?
Severity is Rootly’s built-in property describing how bad an incident is while it’s happening; priority is typically a custom field layered on top to capture how urgent it is to fix. For example, a minor bug affecting a major customer might be SEV3 severity but P1 priority. Rootly doesn’t ship priority as a built-in — add it as a custom field if you need it. Learn more: Severities.What’s the difference between the Resolved and Closed statuses?
Resolved means active incident response has completed and service impact has ended — this is typically when retrospective work begins. Closed is an optional terminal status (enabled via team configuration) that marks an incident as fully finalized after review; it requires the incident to already be Resolved. If your team hasn’t enabled Closed, Resolved serves as the terminal status. Learn more: Incident Status.What are private incidents and who can see them?
Private incidents restrict sensitive operational, customer, or security-related information to a limited group of responders, adding a second layer of access control on top of workspace-wide RBAC. Users can access a private incident either through a role that grants private incident read access, or by being explicitly invited through the Manage Access dialog in the web UI or Slack. Learn more: Private Incidents.Can I split a large incident into sub-incidents?
Yes. A sub-incident is a normal incident linked to a parent viaparent_incident_id, letting a team investigate and coordinate their scope independently while keeping shared context with the parent. Each parent incident can have multiple sub-incidents, which is useful for large, cross-functional incidents. Learn more: Creating Sub-Incidents.
Alerts & Noise Reduction
How does alert deduplication work?
Alert Deduplication collapses repeat events from the same monitor onto a single open Rootly alert, so responders see a rising event count instead of getting paged again. Rootly provides two layers: configurable per–Alert Source deduplication using a stable unique identifier (extracted via JSONPath from the payload or from an alert field, optionally normalized with a regex), plus payload-based exact-body suppression as a backstop. Learn more: Alert Deduplication.What’s the difference between alert deduplication and alert grouping?
Use deduplication when the same monitor keeps re-firing while an issue is unresolved; use grouping when different monitors all fire on the same underlying problem (for example latency, error rate, and DB health alerts at once). Alert Grouping consolidates related alerts into a single leader alert with member alerts — responders are paged for the leader, and matching alerts join the group silently. You can enable both together. Learn more: Alert Grouping.How does alert routing decide who gets notified?
Alert Routes define when, how, and to whom Rootly sends incoming alerts, evaluating conditions against Alert Sources, normalized Alert Fields, and raw payload values via JSONPath. Matching alerts are routed to teams, services, or escalation policies, giving you one centralized routing layer that works consistently across all your monitoring tools. Learn more: Alert Routing.What does alert urgency control?
Alert Urgency controls how quickly responders must act on an alert — how aggressively Rootly pages on-call responders, whether notifications are audible or quiet, and which escalation paths apply during or outside working hours. Rootly ships with High, Medium, and Low urgency levels by default, and you can add, rename, and reorder urgencies. Learn more: Alert Urgency.How do I monitor cron jobs and background workers with Rootly?
Use Heartbeats: they require your systems to “check in” on a regular cadence, and if a heartbeat misses its expected interval, Rootly automatically triggers an alert and notifies the appropriate on-call responders. Each heartbeat cycles through waiting, active, and expired statuses, making it easy to catch silent failures in cron jobs, schedulers, and background workers. Learn more: Heartbeats.On-Call & Paging
How do I set up an on-call schedule?
Navigate to On-Call → Schedules, click + New Schedule, name it, and define rotations that determine who is on call and when responsibility hands over. Note that schedules alone don’t trigger paging — they must be linked to an Escalation Policy to become part of the alerting process. Creating or editing schedules requires the On-Call Admin or On-Call User role. Learn more: On-Call Schedules.How do escalation policies work?
Escalation Policies define who is notified first when an alert fires, what happens if no one acknowledges it, and how long Rootly keeps escalating before stopping. Policies are assigned to a Team or Service, and each new policy automatically includes a Default Escalation Path with audible notifications that acts as a fallback. Learn more: Escalation Policies.How do I page someone manually?
Manual paging lets you page a specific user, team, service, functionality, or escalation policy directly from Rootly Web, Slack, or the mobile app — useful for escalating to another team or looping in a subject matter expert. Paging a team or service runs the same escalation policy as a programmatic alert, so the behavior is identical to automated paging. Learn more: Manual Paging.How do I cover an on-call shift when someone is unavailable?
Create an override: it temporarily assigns a specific shift to a different user while leaving the underlying rotation unchanged, making it the safest way to handle short-term coverage changes. Overrides always apply to individual users, take precedence over rotation-based shifts, and Rootly validates them to prevent overlaps or paging conflicts. Learn more: Editing Schedules & Overrides.Can Rootly route phone calls to on-call engineers?
Yes. Live Call Routing gives you dedicated phone numbers that either connect callers live to the current on-call team member or route to a voicemail where the message is logged and the team is alerted. It also supports IVR calling trees for directing callers to the right team. Learn more: Live Call Routing.Workflows & Automation
What can I automate with Rootly workflows?
Workflows are Rootly’s automation engine: they combine trigger events, run conditions, and actions to remove repetitive coordination work during incident response. Common patterns include creating incident channels in Slack or Microsoft Teams, posting periodic status reminders, notifying legal or support teams on high-impact incidents, creating Jira or Linear tickets, and spinning up Zoom or Google Meet bridges for high-severity incidents. Learn more: Workflows Overview.Can I run a workflow manually?
Yes. Beyond automatic trigger-based execution, workflows can be run on demand via a Slack command, an interactive Slack modal, or directly from an incident in the web UI. Manual runs still respect permissions — if you can’t trigger workflows for a given incident, Rootly blocks the action. Learn more: Manually Running Workflows.Can workflows keep Jira tickets in sync with incident action items?
Yes. Action item workflows trigger whenever action items are created, updated, assigned, or completed, so you can automatically create or update Jira (or other ticketing) issues, assign tickets based on the Rootly assignee, and notify owners when work is assigned or overdue. They trigger on action item events but can still use incident properties like severity or team as run conditions. Learn more: Action Item Workflows.Rootly AI
What is Rootly AI in Slack?
Rootly AI is an AI agent that works inside your Slack incident channels, the Slack assistant pane, and DMs — type@Rootly to catch up on an incident, update severity, draft customer comms, or page another team without leaving Slack. It reads from your Rootly data, channel messages, and bridge call transcripts (when available), and it can only take actions that you as a user have permission to perform. Learn more: Rootly AI in Slack.
What data does Rootly AI access?
Rootly AI reads only the incident and conversation context for the request in front of it — never your broader Rootly data or message history. In Slack it does not crawl historical messages, browse channels it hasn’t been invited to, or call Slack’sconversations.history API; in the web and mobile apps it sees only the incident you’re viewing and your conversation with it. Learn more: Data Privacy for Rootly AI.