---
title: "Recipe: Incident response and on-call paging"
description: "TL;DR: When a critical alert fires in Sentry or Datadog, this playbook opens a PagerDuty incident, creates a Slack war-room channel, posts the alert context and runbook links, and pages the on-call engineer. Trigger is a monitoring webhook; outputs are a PagerDuty incident and a Slack channel."
canonical_url: "https://docs.ballet.dev/articles/recipe-incident-response-and-on-call-paging-B55suUJyoW"
md_url: "https://docs.ballet.dev/articles/recipe-incident-response-and-on-call-paging-B55suUJyoW.md"
---
# Recipe: Incident response and on-call paging

**TL;DR:** When a critical alert fires in Sentry or Datadog, this playbook opens a PagerDuty incident, creates a Slack war-room channel, posts the alert context and runbook links, and pages the on-call engineer. Trigger is a monitoring webhook; outputs are a PagerDuty incident and a Slack channel.

## Who this is for

Engineering and reliability teams that need fast, consistent incident kickoff.

## What you'll need

- **Connectors:** Sentry or Datadog, PagerDuty, Slack.
- **Secrets:** Monitoring API key, PagerDuty routing key, Slack token.
- **Trigger:** Webhook from Sentry/Datadog on a critical alert.

## How to build it with Ask Ballet

1. Open the Console on Home.
2. Paste the prompt below; set severity rules and runbook links.
3. Review the plan and confirm.
4. Connect the monitoring tool, PagerDuty, and Slack, then add the alert webhook.

```text
Build a playbook that triggers on a Datadog alert webhook with severity critical.
Create a PagerDuty incident on the platform on-call service with the alert title and
link. Create a Slack channel named incident-<date>-<short-id>, post the alert summary,
affected service, dashboard link, and our runbook, and invite the on-call engineer and
#eng-leads. Update the PagerDuty incident with the Slack channel link.
```

## What the playbook does

1. **Webhook trigger** — receives the critical alert.
2. **Code step (parse)** — extracts service, severity, and links.
3. **HTTP step (PagerDuty)** — opens the incident and pages on-call.
4. **HTTP step (Slack)** — creates the war-room channel and posts context.
5. **HTTP step (link back)** — adds the Slack channel to the PagerDuty incident.

## Variations and tips

- Gate channel creation on severity so only criticals create war-rooms.
- For customer-facing impact, notify support via [Escalations and SLA breaches](/articles/recipe-escalate-sla-breaches-and-priority-tickets-7RFVotelRJ).
- Add a post-incident step that drafts a timeline from the Slack channel.

## Related articles

- [Error triage](/articles/recipe-triage-new-errors-into-tracked-issues-2RazVCF2Zk)
- [Escalations and SLA breaches](/articles/recipe-escalate-sla-breaches-and-priority-tickets-7RFVotelRJ)
- [What triggers can start a playbook?](/articles/what-triggers-can-start-a-playbook-manual-schedule-webhook-P4mdwPZDGg)
- [How do I store credentials with Secrets?](/articles/how-do-i-store-credentials-with-secrets-1D8OUcCo0n)