n8n Incident Triage: Claude + Slack Approval & Remediation

Automate incident triage with Claude, get Slack approvals, and log remediation outcomes end-to-end in n8n

This n8n workflow, n8n Incident Triage: Claude + Slack Approval & Remediation, ingests incidents, pulls monitoring metrics and recent deploy history, uses Anthropic Claude to triage and select a remediation action, then requests Slack approval when risk is medium/high—while logging every outcome to your incident manager and sending a final digest.

What this workflow does

• Trigger & normalize: Runs on a schedule, via an incident intake webhook, or from a manual test trigger to normalize incoming incident payloads.
• Build an incident queue: Creates a processing queue from incident details or fetches open incidents from an incident manager API.
• Gather diagnostics: For each incident, retrieves a recent metrics snapshot from a monitoring API and recent deployment data from a CI/CD or deploy-history API.
• Claude triage & remediation plan: Sends diagnostics to Anthropic Claude to generate a triage assessment, propose a single runbook remediation action, and determine a risk level.
• Slack approval gate: If the action is medium/high risk (or exceeds an auto-remediation severity threshold), the workflow posts an approval request to Slack and marks remediation as pending.
• Execute or wait: If approval is not required, it executes the runbook action via a runbook engine API and records the result.
• Status updates & logging: Claude drafts a stakeholder status update posted to Slack, and the full incident outcome is logged to the incident manager API before processing the next incident.
• Final digest: Posts a final Slack digest and returns it via the webhook response.

Use cases

• SaaS operations teams triaging alerts with both metrics and deploy context.
• Automation engineers reducing MTTR by gating higher-risk remediations behind Slack approvals.
• Incident response workflows that require auditable logging to an incident manager API.

Technical details

• n8n trigger types: schedule, webhook, manual test
• Nodes/logic used: if, set, code, webhook, sticky note, http request
• External integrations: Anthropic Claude, Slack, monitoring API, CI/CD or deploy-history API, runbook engine API, incident manager API