Skip to main content

​
Overview

Create sub-incidents directly from an incident’s Slack channel using Rootly slash commands.
Sub-incidents help teams split large or cross-functional incidents into focused workstreams while keeping everything tied back to the parent incident. If two incidents were declared separately and turn out to be part of the same event, attach the existing incident to its parent from Slack instead of creating a new one.

​
Restrictions

Sub-incident creation is only available when:
  • You run the command inside an incident channel
  • The incident is not already a sub-incident
  • You have permission to create incidents
  • The incident has no restrictions (for example, cannot split a sub-incident)
If these conditions are not met, Slack will show an appropriate error.

​
How to Create a Sub-Incident in Slack

​
1. Run the Sub-Incident Command

In the parent incident channel, type any of the following:
These commands all trigger the Create Sub-Incident dialog.
Sub-incident Slack dialog

​
2. Complete the Creation Dialog

Fill in the incident fields as you normally would.
Rootly automatically links the new incident as a sub-incident of the channel you ran the command from. After submitting, Slack will confirm that the sub-incident has been created: You’ll then see a reference to the new sub-incident in the parent incident’s summary, Slack channel, and web interface.

​
What Happens Behind the Scenes

Rootly automatically:
  • Sets the new incident’s parent_incident_id
  • Assigns a sub-incident kind (for example, normal_sub, scheduled_sub)
  • Attributes the creation to Slack
  • Optionally creates a Slack channel for the sub-incident (team settings apply)
  • Triggers any workflows conditioned on
    Kind → is one of → normal_sub / scheduled_sub / test_sub
Sub-incidents created via Slack behave exactly the same as those created in the Web UI. They inherit parent properties according to your workspace configuration and any workflows you’ve defined on sub-incident creation.

​
Attach an Existing Incident to a Parent

Attach an incident that already exists to a parent without leaving Slack. This matches Attach to Parent Incident in the web interface. Attaching is available when:
  • You’re in the incident channel of the incident you want to attach
  • The incident has no parent and no sub-incidents of its own
  • You have permission to update the incident
Attach the incident from its own channel.
1

Open the Attach Modal

Start from the channel of the incident that should become the sub-incident. Run the command below, or click Attach to Parent on the incident overview.
2

Choose the Parent

Search for the parent incident in the modal. The list only shows incidents of the same kind as the current incident, and leaves the current incident out.
3

Submit the Modal

Submit the modal to attach the incident.
Once attached:
  • The incident becomes a sub-incident of the parent you picked
  • Both incident timelines record the change, and Rootly posts it in both Slack channels
  • The parent incident lists it with its other sub-incidents

​
Demo

​
Best Practices

  • Use sub-incidents to divide ownership across SRE, Security, Networking, or other teams.
  • Keep the parent incident customer-facing while sub-incidents track internal or deep-dive workstreams.
  • Use workflows to automate structure, such as creating roles or tasks for each new sub-incident.
  • Name sub-incidents clearly to reflect their specific investigative track.
  • Avoid splitting unless the scope is meaningfully distinct—small tasks are usually better captured as action items.

​
Troubleshooting

Slack restricts /rootly sub to incident channels only.
Run the command inside the relevant incident channel.
Sub-incidents cannot be split further.
Create sub-incidents from parent incidents only.
Your role does not have permission to create incidents.
Contact your Rootly admin to update your permissions.
This may occur if:
  • Required fields were left blank
  • Your Slack integration is temporarily disconnected
  • A workflow with a blocking condition prevented sub-incident creation
Ensure that:
  • The originating channel was the correct parent incident channel
  • The parent incident is not archived or cancelled
  • The sub-incident was created successfully (Slack will show a confirmation)
Attaching isn’t available when:
  • The incident already has a parent
  • The incident has its own sub-incidents (nested sub-incidents are not allowed)
  • You lack permission to update the incident
Remove the existing parent or sub-incident links in the web interface first, or ask your Rootly admin for update permission.
The list only shows incidents that:
  • Are the same kind as the current incident, so you can’t attach a normal incident to a scheduled maintenance incident
  • You can view (private incidents appear only if you have access)
Check the parent’s kind, or ask to be added to the private incident.