Skip to main content

​
Overview

Slack is one of the fastest and most natural places to declare an incident. Whether a responder notices an issue in conversation, spots a customer report, or sees a monitoring message posted into a channel, Rootly’s Slack integration lets you create an incident instantly — directly from where your team already works. Use Slack when you need speed, context, and collaboration without switching tools. Slack-based creation supports:
  • Customizable incident fields
  • Required-field validation
  • Private incident creation
  • Automated Slack channel creation
  • Full integration with workflows and lifecycle updates
Need help installing the Rootly Slack app? See the Slack Integration Guide.

​
Create a New Incident in Slack

1
Method 1 — Use a Slash Command
  1. Type: 
    /rootly new
    in any Slack channel.
  2. Press Enter to open the New Incident form.
This is the fastest way to start a new incident manually.Method 2 — Create an Incident From a Slack MessageUse this when the trigger is a message, alert, screenshot, or customer report already posted in Slack.
  1. Hover over the message
  2. Click More actions (three dots)
  3. Select Create an incident
The New Incident form will open pre-filled with a link to the original message, giving responders immediate context.
Message-based creation provides the clearest starting point for responders and is ideal for customer complaints, noisy alerts, or discussions that evolve into incidents.
2

Fill In the Incident Details

The New Incident form appears as a Slack modal and includes the essential fields needed to start coordinated response.Most fields are customizable in Configuration → Forms.New incident form in Slack.Default Fields
FieldDescription
TitleTitle of the incident; also used to name the Slack incident channel.
SummaryA concise description of the issue.
SeverityDefault levels SEV3 → SEV0.
TypeDefault categories: Cloud, Security, Customer-Facing, Default.
Mark as PrivateRestricts visibility to permitted users.
Additional Notes
  • Required fields are marked with a *
  • Leaving Title blank triggers the Automatic Incident Title Generator
  • Only privileged users can create or access Private incidents
  • Private mode is ideal for sensitive or security-related issues
If your team uses Mark as In Triage, selecting it will start the incident in Triage instead of Started. See Incident Lifecycle for details.
3

Create the Incident

Click Create.Rootly will immediately:
  • Create a dedicated Slack incident channel
  • Post the initial system message
  • Log the creation event in the Timeline
  • Trigger any configured workflows
    • Role assignment
    • Stakeholder notifications
    • Ticket creation
    • Checklists
    • Channel topic updates
Newslackincident2 Web
Most teams automate channel setup, role assignments, and initial communication, so responders can focus on investigation — not coordination.

​
After the Incident Is Created

The Slack incident channel becomes your command center. From here you can:
  • Update lifecycle status with /rootly status
  • Resolve or cancel with /rootly resolve or /rootly cancel
  • Add timeline events
  • Modify fields using /rootly edit
  • Run workflows using /rootly workflow
  • Generate an AI summary using /rootly summary
  • Invite responders and collaborate in real time
All changes sync automatically with the Rootly Web UI and appear in the Timeline.

​
Customizing the Slack Incident Form

Your Slack form can be fully tailored to match your Web UI form.
1

Open Form Configuration

To customize:
  1. Go to Configuration → Forms
  2. Under Default Forms, click Configure on New Incident
  3. Select the Slack tab
  4. (Optional) Click Copy fields from Web form
The editor shows:
  • Left side → the form structure
  • Right side → real-time preview Edit new incident form for Slack.
2

Edit and Manage Fields

You can customize:
  • Field order
  • Field visibility
  • Required fields
  • Custom field types (dropdowns, multi-selects, relations, etc.)
Controls:
  • Drag handle → reorder
  • Pencil icon → edit
  • Minus icon → remove
  • Add Fields → add new fields
Changes save automatically.
We recommend keeping Slack and Web forms aligned. This ensures responders have a consistent experience no matter where incidents originate.

​
Troubleshooting

Make sure you’re inside a Rootly incident channel, not a normal channel.
You need the correct permissions (owner/admin/private-incident access).
Your workspace likely uses sub-statuses, which disable the mitigate command.
Use /rootly status instead.
Your workspace may enforce:
  • Required fields
  • Conditional fields
  • Required lifecycle metadata
Check for missing fields marked with *.
Check:
  • Slack integration is connected
  • Auto-create channels is enabled
  • Private incident behavior matches workspace rules

​
Best Practices

  • Prefer message-based creation for rich context
  • Keep fields minimal but meaningful
  • Use Private mode for sensitive incidents
  • Train responders to use /rootly status for lifecycle updates
  • Align Slack + Web forms for consistency
  • Automate repetitive tasks (channel setup, assignments, notifications)
High-quality incident creation through Slack accelerates response, reduces confusion, and keeps everyone aligned from the very first minute.