id: ai-incident-triage-response
namespace: io.kestra.examples

description: |
  An AI-powered incident triage and automated response workflow for
  production engineering teams. It analyzes an unstructured incident,
  extracts structured incident intelligence, determines severity and
  customer impact, recommends an initial response, and escalates
  urgent incidents through Slack.

inputs:
  - id: incident_title
    type: STRING
    defaults: "Production API returning HTTP 500 errors"
    description: >
      Short title describing the production incident.

  - id: incident_description
    type: STRING
    defaults: >
      The production API is returning HTTP 500 errors for approximately 40
      percent of requests. Customers are reporting failed requests and the error
      rate has increased significantly during the last 15 minutes.
    description: >
      Detailed description of the incident including symptoms, scope, affected
      users, and observed impact.

  - id: affected_service
    type: STRING
    defaults: "production-api"
    description: >
      Name of the application, service, or infrastructure component affected by
      the incident.

tasks:
  - id: analyze_incident
    type: io.kestra.plugin.ai.completion.JSONStructuredExtraction

    schemaName: incident_triage

    jsonFields:
      - severity
      - category
      - customer_impact
      - confidence
      - recommended_action

    description: >
      Analyze the incident with AI and extract structured severity, category,
      customer impact, confidence, and recommended response information.

    provider:
      type: io.kestra.plugin.ai.provider.OpenAI
      apiKey: "{{ secret('OPENAI_API_KEY') }}"
      modelName: gpt-5-mini

    systemMessage: |
      You are an experienced Site Reliability Engineer performing
      first-response production incident triage.

      Analyze only the information provided by the incident.
      Do not invent facts or assume information that is not present.

      Severity must be exactly one of:

      P0 Critical
      P1 High
      P2 Medium
      P3 Low

      Severity definitions:

      P0 Critical:
      Widespread or severe production impact requiring immediate response.

      P1 High:
      Significant production impact requiring urgent engineering attention.

      P2 Medium:
      Limited impact requiring normal investigation.

      P3 Low:
      Informational, minor, or low-impact issue.

      Category must be exactly one of:

      availability
      performance
      security
      data
      other

      Customer impact must be exactly one of:

      none
      low
      medium
      high
      widespread

      Confidence must be exactly one of:

      low
      medium
      high

      The recommended action must be a concise first-response action
      an engineer should consider.

      Base the assessment only on the incident title,
      affected service, and incident description.

    prompt: |
      Analyze the following production incident.

      Incident title:
      {{ inputs.incident_title }}

      Affected service:
      {{ inputs.affected_service }}

      Incident description:
      {{ inputs.incident_description }}

      Return the following structured information:

      severity:
      P0 Critical, P1 High, P2 Medium, or P3 Low.

      category:
      availability, performance, security, data, or other.

      customer_impact:
      none, low, medium, high, or widespread.

      confidence:
      low, medium, or high.

      recommended_action:
      A concise first-response action for the engineering team.

  - id: route_incident
    type: io.kestra.plugin.core.flow.If

    description: >
      Route critical and high-severity incidents to the urgent escalation path
      while sending medium and low-severity incidents to the normal
      investigation path.

    condition: >-
      {{
        fromJson(outputs.analyze_incident.extractedJson).severity == 'P0 Critical'
        or
        fromJson(outputs.analyze_incident.extractedJson).severity == 'P1 High'
      }}

    then:

      - id: build_escalation_summary
        type: io.kestra.plugin.core.debug.Return

        description: >
          Build an actionable escalation summary containing the AI assessment
          and the original incident context.

        format: |
          INCIDENT ESCALATION REQUIRED

          Severity:
          {{ fromJson(outputs.analyze_incident.extractedJson).severity }}

          Category:
          {{ fromJson(outputs.analyze_incident.extractedJson).category }}

          Customer impact:
          {{ fromJson(outputs.analyze_incident.extractedJson).customer_impact }}

          AI confidence:
          {{ fromJson(outputs.analyze_incident.extractedJson).confidence }}

          Service:
          {{ inputs.affected_service }}

          Title:
          {{ inputs.incident_title }}

          Recommended action:
          {{ fromJson(outputs.analyze_incident.extractedJson).recommended_action }}

          Original incident:
          {{ inputs.incident_description }}

      - id: notify_incident_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook

        description: >
          Notify the incident-response team through Slack when an urgent
          incident requires immediate engineering attention.

        url: "{{ secret('SLACK_WEBHOOK_URL') }}"

        messageText: |
          🚨 INCIDENT ESCALATION

          Severity:
          {{ fromJson(outputs.analyze_incident.extractedJson).severity }}

          Category:
          {{ fromJson(outputs.analyze_incident.extractedJson).category }}

          Customer impact:
          {{ fromJson(outputs.analyze_incident.extractedJson).customer_impact }}

          AI confidence:
          {{ fromJson(outputs.analyze_incident.extractedJson).confidence }}

          Service:
          {{ inputs.affected_service }}

          Title:
          {{ inputs.incident_title }}

          Recommended action:
          {{ fromJson(outputs.analyze_incident.extractedJson).recommended_action }}

          Incident:
          {{ inputs.incident_description }}

          Automatically triaged by Kestra AI Incident Triage.

    else:

      - id: record_routine_incident
        type: io.kestra.plugin.core.debug.Return

        description: >
          Record lower-severity incidents for normal engineering investigation
          without triggering urgent escalation.

        format: |
          INCIDENT TRIAGED

          Severity:
          {{ fromJson(outputs.analyze_incident.extractedJson).severity }}

          Category:
          {{ fromJson(outputs.analyze_incident.extractedJson).category }}

          Customer impact:
          {{ fromJson(outputs.analyze_incident.extractedJson).customer_impact }}

          AI confidence:
          {{ fromJson(outputs.analyze_incident.extractedJson).confidence }}

          Service:
          {{ inputs.affected_service }}

          Title:
          {{ inputs.incident_title }}

          Recommended action:
          {{ fromJson(outputs.analyze_incident.extractedJson).recommended_action }}

          No immediate escalation is required.

  - id: incident_summary
    type: io.kestra.plugin.core.debug.Return

    description: >
      Produce a final summary of the completed AI incident-triage assessment and
      routing decision.

    format: |
      INCIDENT TRIAGE COMPLETED

      Title:
      {{ inputs.incident_title }}

      Service:
      {{ inputs.affected_service }}

      Severity:
      {{ fromJson(outputs.analyze_incident.extractedJson).severity }}

      Category:
      {{ fromJson(outputs.analyze_incident.extractedJson).category }}

      Customer impact:
      {{ fromJson(outputs.analyze_incident.extractedJson).customer_impact }}

      AI confidence:
      {{ fromJson(outputs.analyze_incident.extractedJson).confidence }}

      Recommended action:
      {{ fromJson(outputs.analyze_incident.extractedJson).recommended_action }}

triggers:
  - id: incident_webhook
    type: io.kestra.plugin.core.trigger.Webhook

    description: >
      Receive incident events from monitoring systems, applications, alerting
      platforms, or custom integrations.

    key: AIIncidentTriage2026

AI-Powered Incident Triage & Automated Response

Production incidents often arrive as unstructured alerts, monitoring events, application errors, infrastructure notifications, or customer reports. During an incident, engineers need to quickly understand the severity, scope, customer impact, and appropriate first response.

This Blueprint automates the first stage of incident response by using an AI model to transform an unstructured incident description into structured incident intelligence.

What this Blueprint does

The workflow:

Receives an incident through configurable workflow inputs.
Analyzes the incident using an AI model.
Extracts structured incident intelligence.
Determines the incident severity.
Determines the affected category.
Estimates customer impact.
Assigns an AI confidence level.
Generates a recommended first-response action.
Routes urgent incidents through a conditional flow.
Sends urgent incidents to the engineering team through Slack.
Records lower-severity incidents for normal investigation.
Produces a final incident-triage summary.

Workflow

The workflow follows this sequence:

Incident ↓ AI Structured Analysis ↓ Severity + Category + Customer Impact ↓ Confidence + Recommended Action ↓ Conditional Routing ↓ ┌───────────────────────┐ │ P0 Critical / P1 High │ └───────────┬───────────┘ │ Yes ──┴── No ↓ ↓ Slack Alert Routine Investigation ↓ ↓ └────┬────┘ ↓ Final Summary

AI-generated incident intelligence

For each incident, the AI determines:

Severity: P0 Critical, P1 High, P2 Medium, or P3 Low
Category: availability, performance, security, data, or other
Customer impact: none, low, medium, high, or widespread
Confidence: low, medium, or high
Recommended action: a concise initial response for engineers

Severity model

P0 Critical

Widespread or severe production impact requiring immediate response.

Examples include:

Major production outage
Widespread API failure
Critical service unavailable
Severe customer-facing failure

P1 High

Significant production impact requiring urgent engineering attention.

Examples include:

Large percentage of failed requests
Major degradation of a production service
Significant customer-facing errors
Important production functionality unavailable

P2 Medium

Limited impact that should be investigated during normal operations.

Examples include:

Partial degradation
Limited customer impact
Non-critical service problems
Performance issues with limited scope

P3 Low

Informational, minor, or low-impact issue that does not require immediate escalation.

Automated routing

P0 and P1 incidents are automatically routed to the urgent-response path.

The urgent path:

Creates an escalation summary.
Sends a Slack notification.
Includes the AI assessment.
Includes the recommended response.
Includes the affected service.
Preserves the original incident information.

P2 and P3 incidents follow the routine investigation path and do not generate an urgent Slack escalation.

Example incident

A monitoring platform reports that a production API is returning HTTP 500 errors for a large percentage of requests and customers are experiencing failed requests.

The AI can classify the event as a high-severity availability incident, estimate customer impact, provide a confidence level, and recommend an initial engineering response.

Example AI result

A possible structured assessment can look like:

Severity: P1 High
Category: availability
Customer impact: high
Confidence: high
Recommended action: investigate the API deployment and error logs, verify upstream dependencies, and begin rollback or mitigation if the failure is deployment-related.

The exact result depends on the incident information provided to the AI model.