DevOps Alert Triage Automation with Claude, GitHub & Slack

Turn monitoring alerts into triaged action—automatically

This n8n workflow receives monitoring alerts via webhook, uses Claude to triage and draft an incident remediation plan with supporting context from GitHub, docs, and Terraform Cloud, then either executes allowlisted low-risk fixes or escalates to on-call via ClickUp and Slack.

What this workflow does

• Ingest alerts: Accepts a monitoring alert payload through a POST webhook.
• Claude triage: Uses Anthropic Claude to classify the alert and determine whether it represents a critical production outage.
• Critical path (no auto-remediation): If critical, creates an urgent ClickUp incident ticket and pages the on-call engineer in Slack, bypassing automation.
• Non-critical enrichment: If not critical, retrieves matching runbooks from a documentation knowledge base API, pulls related GitHub issues/PRs, fetches recent ClickUp incident history, and reads the current Terraform Cloud workspace state.
• Remediation planning: Claude generates a remediation plan grounded in that context, including action type, risk level, confidence, and command.
• Execute or escalate:
  • If the plan is allowlisted, low-risk, and high-confidence, an HTTP remediation executor runs the fix, logs a resolved ClickUp ticket, and posts confirmation to a DevOps Slack channel.
  • Otherwise, it opens a ClickUp ticket for manual remediation and notifies on-call in Slack with the plan and supporting context.
• Incident knowledge logging: Records alert details, plan, and outcome to an incident knowledge log API for future improvements.

Use cases

• Automatically triage production monitoring alerts and avoid late response during outages.
• Turn runbooks + GitHub + Terraform Cloud context into consistent remediation plans for non-critical incidents.
• Safely automate only low-risk, allowlisted fixes while escalating ambiguous cases to on-call.

Technical details

• n8n nodes/integrations: if, set, code, merge, Slack, GitHub (plus webhook ingestion and API/HTTP calls for documentation, ClickUp, Terraform Cloud, and remediation execution).
• Core decision logic: Claude-driven classification and remediation planning with extracted risk/confidence gating.

Category: DevOps Alert Triage Automation (n8n automation workflow) for automation engineers and SaaS operators who want faster, safer incident response.