Alertmanager Incident Investigator with GPT-4.1, ClickUp, Slack, PagerDuty

Alertmanager Incident Investigator with GPT-4.1 — RCA to ClickUp + Slack + PagerDuty

When Prometheus Alertmanager fires, this n8n workflow immediately investigates the incident with a GPT-4.1-powered agent, generates a structured root-cause analysis (RCA), logs it to Postgres, creates a ClickUp incident task, notifies Slack, and pages PagerDuty for critical outages.

What this workflow does

• Receives Prometheus Alertmanager webhooks via a POST endpoint (/alertmanager-incident) containing firing alert details.
• Normalizes alert context (alert name, severity, affected service, description, start time) and derives a session ID from the alert fingerprint so follow-up alerts stay in the same investigation thread.
• Runs an OpenAI incident investigator agent using session memory to query your systems (optionally querying your log API and CI/CD deployment API multiple times) and returns structured RCA JSON (root cause, confidence, evidence, likely deployment, severity, and recommended actions).
• Stores audit history in Postgres by inserting the RCA into the incident_analyses table.
• Creates a ClickUp task for the incident and posts a formatted summary (including the ticket link) to a Slack DevOps channel.
• Pages PagerDuty for critical incidents based on the agent-assessed severity, then returns a JSON response to the webhook caller.

Use cases

• Speeding up incident triage when Prometheus alerts spike after deployments.
• Ensuring every incident gets a repeatable RCA with evidence and recommended actions.
• Automating DevOps workflows end-to-end: Alertmanager → investigation → ClickUp → Slack → PagerDuty.

Technical details

• n8n nodes: Webhook, Set, If, Slack, ClickUp, Postgres
• AI: OpenAI Chat Model (GPT-4.1) with session memory; outputs structured RCA JSON
• Core logic: session ID from alert fingerprint, JSON parsing, Postgres insert into incident_analyses, conditional PagerDuty escalation

Ideal for: n8n users, automation engineers, and SaaS operators who want Prometheus-driven incident response with AI-assisted root-cause analysis.