Automation Actions let you define what should happen automatically when something occurs in Vibe OnCall — for example, when a new alert fires, when an incident is declared, or when a war room is created. Each automation pairs a trigger (the event that fires) with one or more actions (what to do in response), optionally gated by conditions so the action only runs in the situations you care about.
With Automation Actions you can send alerts to the right Slack channel, auto-declare incidents from high-severity alerts, pull the right responders into a war room the moment it opens, and keep stakeholders updated as the incident timeline evolves — without anyone lifting a finger.
Every automation is built from three parts:
| Part | What it does |
|---|---|
| Trigger | The event that starts the automation (e.g. a new alert arrives, an incident is declared). |
| Conditions | Filters that decide whether the action should run — based on severity, provider, or any field on the triggering event. |
| Action | What Vibe OnCall should do when the trigger fires and the conditions are met. |
| Trigger | Fires when… |
|---|---|
| Alert Created | A new alert is ingested from any integrated source (Datadog, PagerDuty, Sentry, custom webhook, etc.). |
| Alert Timeline Updated | A new event is added to an alert's timeline — such as a status change, paging notification. |
| Incident Created | A new incident is declared, either manually, by Vibe AI, or via automation. |
| Incident Timeline Updated | A new event is added to an incident's timeline — state change, severity, responder action, or AI summary. |
| Incident War Room Created | A Slack war room channel is provisioned for an incident. |
Vibe OnCall supports the following condition types:
| Condition | What it filters on | Available for |
|---|---|---|
| Field | The alert or incident's title, description, or any key under its metadata (e.g. service, cluster, tag). | Alert and incident triggers |
| Severity | The severity of the triggering event — info / warning / minor / major / critical for alerts, SEV0–SEV5 / SIGNAL for incidents. |
Alert and incident triggers |
| Provider | The integration source the alert came from (Datadog, PagerDuty, custom webhook, etc.). | Alert triggers |
| Team | The team the alert belongs to. | Alert triggers |
Conditions can be combined into groups using AND / OR logic, and groups can be nested — so you can express filters like "(provider is Datadog AND severity is SEV0 or SEV1) OR (provider is PagerDuty AND severity is SEV0)".
| Action | What it does | Useful for |
|---|---|---|
| Publish to Channel | Posts a Slack message about the alert or incident, formatted automatically with the key details. | Broadcasting alerts to an on-call channel, or sharing incident updates in a status channel. |
| Send Direct Message | Sends a Slack DM to one or more specific people. | Paging an individual responder, or quietly pinging a stakeholder without filling a public channel. |
| Invite Users to Channel | Pulls people into a Slack channel — usually the war room — as soon as it opens. | Making sure the right responders are already in the room when the conversation starts. |
| Declare Incident | Turns the triggering alert into a new incident. | Spinning up incident response automatically for high-severity alerts, instead of waiting for someone to declare it by hand. |
| Create Incident Ticket | Files a Jira or Linear ticket from an incident, with title and description drafted from incident context, and links the new ticket back to the incident. | Ensuring every qualifying incident has a tracking ticket in your issue tracker without relying on responders to file one. |