Recipe: Escalate SLA breaches and priority tickets
1min read
TL;DR: On a schedule (or on ticket update), this playbook finds tickets at risk of breaching SLA or marked urgent, escalates them to the on-call owner via PagerDuty, and posts an alert to Slack with the ticket and remaining time. Trigger is a schedule or webhook; outputs are a PagerDuty alert and a Slack message.
Who this is for
Support leads protecting response and resolution SLAs for high-priority customers.
What you'll need
- Connectors: Freshdesk or Zendesk, PagerDuty, Slack.
- Secrets: Helpdesk API key, PagerDuty routing key, Slack token.
- Trigger: Schedule (e.g. every 15 minutes) or a webhook on ticket update.
How to build it with Ask Ballet
- Open the Console on Home.
- Paste the prompt below; set your SLA thresholds and channels.
- Review the plan and confirm.
- Connect the helpdesk, PagerDuty, and Slack, then set the schedule.
Build a playbook that runs every 15 minutes. Query Zendesk for open tickets where the
priority is high or the SLA due time is within the next 30 minutes. For each at-risk
ticket, trigger a PagerDuty alert to the support on-call service and post a message to
#support-escalations in Slack with the ticket link, customer, priority, and time
remaining. Avoid duplicate alerts for tickets already escalated in the last hour.
What the playbook does
- Schedule trigger — runs at a fixed interval.
- HTTP step (query) — fetches open tickets nearing SLA breach or marked urgent.
- Code step (filter) — de-duplicates already-escalated tickets and computes time remaining.
- HTTP step (PagerDuty) — opens an alert for the on-call service.
- HTTP step (Slack) — posts the escalation summary.
Variations and tips
- Track escalated ticket IDs in a Code step to prevent duplicate pages.
- For incidents that span systems, hand off to the Incident response and on-call recipe.
- Tune the schedule frequency to your tightest SLA window.