n8n Incident Response Workflow: Postgres + Slack + Email

Turn incident alerts into a coordinated response—automatically

This n8n Incident Response Workflow connects Postgres, Slack, and Email to track incidents, launch a Slack war-room, page responders via email, escalate when nobody acknowledges, send periodic status updates, and close incidents with resolution notifications.

What this workflow does

Designed to streamline incident management, it performs the following:

• Receives alerts through the POST /bc-alert webhook (including simple JSON and Prometheus Alertmanager-style payloads), normalizing them into service, severity, and status fields.
• Creates or deduplicates incidents in Postgres—either opening a new incident or attaching the alert to an existing open incident for the same service—then returns a 202 response with the incident ID and deduplication status.
• Launches the response for new incidents by loading service metadata and team contacts from Postgres, creating a Slack war-room channel, posting an incident brief and checklist, and emailing each responder a unique acknowledgement link.
• Captures acknowledgement via GET /bc-ack, updates the incident in Postgres, and posts a Slack message naming the incident commander.
• Escalates and reports status every 5 minutes: it finds unacknowledged incidents needing escalation and open incidents due for updates, then sends escalation notices via Slack and email to stakeholders.
• Closes incidents when resolution is submitted via POST /bc-resolve, marking the incident resolved in Postgres, posting resolution + duration to Slack, and emailing stakeholders (including executives, as provided in workflow data).

Use cases

• Operating a SaaS where Prometheus Alertmanager notifications must trigger consistent, fast on-call response.
• Centralizing incident tracking in Postgres while using Slack channels for war-room coordination.
• Reducing alert noise by deduplicating incidents per service until they are acknowledged or escalated.

Technical details

• n8n webhook endpoints: POST /bc-alert, GET /bc-ack, POST /bc-resolve
• Integrations / nodes: webhook, postgres, if, set, code, switch
• Channels: Slack war-room + email paging and stakeholder updates