Skip to main content
Workflows is currently in Alpha. Functionality and configuration options may change.
Your team’s best process exists somewhere: a post-mortem action item, a senior engineer’s mental checklist, a runbook that works when it’s followed. Workflows let you define that process once and have it run every time, against every relevant event, without relying on anyone to remember.

Runs on your schedule

Weekly drift checks, Monday morning health scans, post-deploy validations. Triggered automatically, no manual step needed.

Fires on events

A Grafana IRM alert, a merged PR, a Slack alert. Any event can trigger a workflow that runs analysis and posts findings to the right channel before your team has typed a word.

Any team member can run it

Type /triage payment-api in Chat, Slack, or the CLI. The full workflow runs inline with full system context. No copy-paste, no runbook-hunting.

Full audit trail

Every execution (who triggered it, what it ran, what it returned, how long it took) is written to the audit log. No black boxes.

​
What Workflows does

A Workflow is a named sequence: a trigger and a set of instructions, run by the NOFire agent with access to your full system context (metrics, logs, traces, GitHub, Slack, and the connections you’ve configured). Three ways to trigger: Scheduled: runs on a set interval, automatically.
“Every Monday at 9am, scan all services that touch the payments flow for drift from the week before.”
Event-triggered: fires when something happens. A merged PR, a Grafana IRM alert, a Slack alert, or a webhook from any external system.
“Whenever a Grafana IRM alert fires, run a blast-radius analysis and post the findings to the incident channel.”
Slash command: any team member invokes it by name, from Chat, Slack, or the CLI.
“Any engineer types /post-mortem last 7 days and gets a structured draft from the full evidence timeline.”

​
Getting started

Prerequisites
  • NOFire is connected to your data sources (Quickstart)
  • You have Admin or Editor access in your NOFire account
1

Open Workflows

Click Workflows in the left sidebar and then New workflow in the top-right corner.You can also start from a pre-built template. Open the Catalog tab, find a template that fits, and click Add.
2

Name it and write the instructions

Give it a clear name and write the instructions in plain language. Reference specific services, metrics, or alert names to give the agent the right starting point.
3

Choose a trigger

Select one of the six trigger types:
  • Schedule: pick a repeating interval (every 5, 15, or 30 minutes, hourly, every 6 or 12 hours), a daily time, or a specific day and time each week.
  • Slack alert: fires when an alert arrives in your connected Slack workspace. Filter by severity: any, medium and above, high and above, or critical only.
  • Grafana IRM: fires on Grafana IRM alert events via your configured webhook.
  • GitHub event: fires on PR opened, push to main, or both.
  • Webhook: any external system can trigger the Workflow via a POST request with a shared secret. Covers PagerDuty, Incident.io, Blameless, FireHydrant, and any other source.
  • Investigation done: fires automatically after any alert investigation finishes.
You can combine triggers. The same Workflow can run on a schedule and also be callable on demand via slash command.
4

Select a cluster

Choose which connected cluster the Workflow runs against.For Slack alert, GitHub event, and Grafana IRM triggers, the cluster is resolved automatically from the firing connection. For Schedule, Webhook, and Investigation done triggers, select a fixed cluster from the dropdown or provide an expression to read the cluster name from the trigger data.
5

Set the output destination

Choose where the Workflow posts its results:
  • Slack channel: posts to a named channel
  • Slack thread (reply): replies in a specific thread
  • Webhook: POSTs the result as JSON to a URL of your choice
  • Nowhere (run history only): result is saved to run history without being delivered anywhere
6

Add a slash command (optional)

In the Slash command section, set a command-name. This makes the Workflow callable by name from Chat. You can also add an args hint (e.g. <service> <version>) to show your team what arguments to pass.Keep the name short and specific (e.g. triage, post-mortem, deploy-check). Command names must be unique within your account.
7

Save and run it manually first

Before relying on scheduled or event triggers, use the Run button to verify the output is what you expect.Each run is saved to the run history. You can inspect the full output, check duration, and link to it from your incident channel.

​
Trigger reference

​
Using slash commands

Every Workflow with a command-name set gets a slash command. Type it anywhere you talk to NOFire:
  • Chat: type /command-name in the NOFire Chat dashboard. This is the primary surface.
  • Slack: send /command-name in any message where NOFire is present. Runs inline in the thread.
  • CLI: type /command-name from the NOFire CLI.
To see all commands defined in your account, open the Commands tab on the Workflows page. Add context after the command name to scope the run:
Slash commands run with the full system context NOFire has for your environment. You don’t need to repeat service names, cluster details, or environment context. NOFire resolves them from your configured connections.

​
Audit trail

Every Workflow execution is written to two independent records automatically. Run history is stored for every execution: Audit log: every execution also writes to the account audit log with the actor identity (user email or system for scheduled runs) and success or failure reason. To review execution history for a single Workflow, open its card and click History. To review across all Workflows, go to Settings → Security → Audit Logs.

​
Access control

Workflows are account-scoped. All users in your account can see and invoke all enabled Workflows. There is no personal vs. team distinction.
  • command_name must be unique within your account.
  • Default Workflows (shipped with your account) cannot be deleted, only disabled.
  • The actor identity on every run is recorded. Scheduled runs show as system; manual and slash-command runs show the user’s email.

​
Next Steps

Organizational Knowledge

Teach NOFire about your environment so Workflow runs have accurate context from the first step

Autonomous Investigations

Invite NOFire to an incident channel and it builds evidence context continuously, complementing Workflows for full incident coverage