Triage new Better Stack incidents in Slack and Linear

PromptCreate

When Better Stack sends a webhook that a new incident has been created, kick off an agent that triages the alert end to end and turns it into a useful heads-up plus a durable follow-up ticket.

Start by pulling the incident's full details and its timeline of events from Better Stack (Get Incident, List Incident Timeline). Then look up the affected monitor with Get Monitor, and grab its recent Get Monitor Response Times so you can describe what state the target is actually in right now — hard down, degraded, timing out, or slow.

Figure out who is currently on call. Use List On-call Schedules to find the relevant schedule for this monitor or team, then Get On-call Schedule to pick out the person who is on the hook right now. Keep their name and email handy for the Slack message and the Linear assignment.

For pattern context, use List Incidents filtered by the same monitor and pull the last several. If any of them resolved within the last 30 days, treat this as a probable repeat and surface that prominently at the top of the Slack message — do not bury it.

Post a rich Slack message to our incidents channel using Slack Send a Message. Include: the monitor name and URL, the likely blast radius in plain English (which service or endpoint this affects), the current status, a suspected cause synthesised from the timeline events and the response-time trend, the on-call engineer, a repeat-incident callout when applicable, and direct links back to the Better Stack incident and monitor pages so people can dig in with one click.

Then open a Linear issue with Linear Create Issue. Use List Teams and List Users to find the on-call engineer's team and Linear user id. Set the priority based on the incident severity, write a short summary, and include a follow-up checklist covering: confirm the alert is real, mitigate, root-cause, add or tune monitoring, and write a postmortem. Assign the issue to the on-call engineer when we can match them; otherwise leave it unassigned so whoever picks up the alert can grab it. Link the Better Stack incident URL in the description.

The Slack message is the primary human-facing output — make it scannable in five seconds. The Linear issue is the durable follow-up so the work of writing a postmortem and tuning monitoring does not fall off the floor after the incident resolves.

Additional information

What does this prompt do?

Pulls the incident details, timeline, and the affected monitor's recent response-time trend so you get real context, not just a bare alert
Checks the last month of incidents on the same monitor and flags prominently if this looks like a repeat of a recently resolved one
Posts a rich Slack message to your incidents channel with likely blast radius, a suspected cause, who is on call, and links back to Better Stack
Opens a Linear issue in the on-call engineer's team with matching severity and a follow-up checklist so postmortem work does not slip

What do I need to use this?

A Better Stack account with monitors and at least one on-call schedule set up
Access to send messages in the Slack channel you want incident heads-ups to land in
A Linear workspace and the team where follow-up issues should be created

How can I customize it?

Change the Slack channel or add role mentions for specific severities
Adjust the repeat-incident lookback window (defaults to the last 30 days)
Pick a different Linear team, priority mapping, or set of default labels for the follow-up issue

Frequently asked questions

Does this replace Better Stack's own Slack alerts?

No, it enriches them. Better Stack's built-in alert is a short line; this workflow adds context like blast radius, response-time trend, and a repeat-incident flag, and it creates a Linear ticket so follow-up work does not get lost once the incident is mitigated.

Will the on-call engineer be assigned the Linear issue automatically?

If we can match the on-call person from Better Stack to a user in your Linear workspace, yes. If not, the issue is created unassigned so whoever picks up the alert can grab it.

What counts as a repeat incident?

By default, if the same monitor has had another incident resolved within the last 30 days, we call it out prominently at the top of the Slack message. You can shorten or lengthen that window.

What if we do not use Linear for engineering work?

The follow-up ticket step can be pointed at another supported tool such as Jira, GitHub, or Height. Let the author know which one you use.

Does the workflow run when incidents auto-resolve?

No. This one only fires on new incidents. A resolution or postmortem digest is a separate workflow.

Related templates

Weekend football matchday preview, posted to Slack

Every Friday, get a ready-to-read preview of your league's weekend matches, with positions, form, scorers to watch, and predicted results, posted to Slack.

5d ago

Agentic Task

Prompt