Automation Actions let you define what should happen automatically when something occurs in Vibe OnCall — for example, when a new alert fires, when an incident is declared, or when a war room is created. Each automation pairs a trigger (the event that fires) with one or more actions (what to do in response), optionally gated by conditions so the action only runs in the situations you care about.
With Automation Actions you can send alerts to the right Slack channel, auto-declare incidents from high-severity alerts, pull the right responders into a war room the moment it opens, and keep stakeholders updated as the incident timeline evolves — without anyone lifting a finger. You can even have an AI assistant automatically triage new alerts and post its findings right under the alert, so responders start with a head start instead of a blank page.
Every automation is built from three parts:
| Part | What it does |
|---|---|
| Trigger | The event that starts the automation (e.g. a new alert arrives, an incident is declared). |
| Conditions | Filters that decide whether an action should run — based on severity, provider, or any field on the triggering event. Conditions can apply to the whole automation (gating every action) and/or to an individual action (gating just that step). An action runs only when both its automation-level and action-level conditions match. |
| Action | What Vibe OnCall should do when the trigger fires and the conditions are met. |
| Trigger | Fires when… |
|---|---|
| Alert Created | A new alert is ingested from any integrated source (Datadog, PagerDuty, Sentry, custom webhook, etc.). |
| Alert Timeline Updated | A new event is added to an alert's timeline — such as a status change, paging notification. |
| Incident Created | A new incident is declared, either manually, by Vibe AI, or via automation. |
| Incident Timeline Updated | A new event is added to an incident's timeline — state change, severity, responder action, or AI summary. |
| Incident War Room Created | A Slack war room channel is provisioned for an incident. |
Vibe OnCall supports the following condition types:
| Condition | What it filters on | Available for |
|---|---|---|
| Field | The alert or incident's title, description, or any key under its metadata (e.g. service, cluster, tag). | Alert and incident triggers |
| Severity | The severity of the triggering event — info / warning / minor / major / critical for alerts, SEV0–SEV5 / SIGNAL for incidents. |
Alert and incident triggers |
| Provider | The integration source the alert came from (Datadog, PagerDuty, custom webhook, etc.). | Alert triggers |
| Team | The team the alert belongs to. | Alert triggers |
Conditions can be combined into groups using AND / OR logic, and groups can be nested — so you can express filters like "(provider is Datadog AND severity is SEV0 or SEV1) OR (provider is PagerDuty AND severity is SEV0)".
Field conditions support these operators: contains, exact match, does not contain, and matches regex (a regular-expression match). Regex patterns are validated when you save and are rejected if they're malformed or unsafe (to protect against runaway matching).
Conditions can be set at two levels: