Incident Response

Set up Droid to respond to production alerts in Slack and resolve or investigate incidents autonomously.

When an alert lands in a configured Slack channel, Factory automatically starts a linked Droid session so Droid can investigate the incident with the right context, machine, and instructions.

Droid can work toward an RCA, open a PR for a fix when appropriate, and update an incident runbook so future investigations of the same alert type start faster.

Configuring Factory channel auto-run requires a Factory Owner or Manager role.

Quickstart: set up from the Factory App

Use the web UI when you want to review all Slack channel settings in one place.

1. Open the Slack integration settings

   In the Factory App, go to Settings → Integrations → Slack. If you have not connected Slack yet, set up the Slack integration first, then open the Slack management view.

2. Invite Factory to the incident channel

   In Slack, open the channel where alert bots post incidents and run:

   /invite @Factory
   

   Only channels where Factory has been invited appear in the channel list.

3. Enable the channel

   In the Slack settings, open the Auto-Backlinking section and enable the incident channel. This links Slack messages in that channel back to Factory sessions.

4. Turn on Auto-Run

   Expand the channel settings and enable Auto-Run. This lets Factory start a Droid session automatically when an incident alert arrives.

5. Choose the session owner and machine

   Select the session owner and the computer or cloud workspace Droid should use. The session owner controls which user identity and permissions the auto-run session uses.

6. Tune visibility, model, and prompt

   Choose whether sessions are private to the owner or visible to the organization, optionally select a model, and set the incident prompt.

   A good starting prompt is:

   Use the `/incident` skill for Slack incidents and run an RCA if applicable.
   If the thread message is an incident or asking for RCA/root-cause analysis, invoke the `incident` skill before investigating.
   
7. Send a test alert

   Post a test top-level alert from the same kind of bot that will send real incidents. Confirm Factory starts an auto-run Droid session and links it from the Slack thread.

Alternative: Set up with Droid CLI

Use the CLI flow when you are already in Droid and want a guided incident-channel setup.

1. Run the setup command

   In the Droid CLI, run:

   /setup-incident-response
   

   If Slack is not connected yet, Droid opens the Slack OAuth flow before continuing.

2. Select the incident channel

   Choose the Slack channel that receives incident alerts. If the channel is missing, invite Factory to it with /invite @Factory and run the setup command again.

3. Select the computer

   Choose the computer Droid should use for incident investigations. Pick the environment with the right repository checkout, observability tools, and credentials.

4. Accept or edit the RCA prompt

   Keep the default incident prompt or add channel-specific instructions, such as which runbooks, dashboards, repositories, or escalation rules Droid should check first.

5. Apply and verify

   Confirm the setup, then send a test alert in Slack to verify that Droid starts automatically.

Configuration details

Customizing the prompt

The channel prompt is injected into every auto-run session for that channel. Keep it specific to incident work:

• Tell Droid to run RCA and use the /incident workflow when appropriate.
• Mention the primary services or repositories for that channel.
• Point Droid at runbooks, dashboards, or common alert sources.
• State escalation expectations, such as when to summarize uncertainty instead of taking action.

Avoid prompts that make the channel a general-purpose automation surface. Incident Response works best when the prompt is narrow and operational.

Channel selection

Incident Response is designed for channels where incident alerts arrive as top-level messages. Thread replies are not used to start new auto-run sessions, which prevents ordinary discussion from repeatedly launching Droids.

For best results, use a dedicated channel such as #incidents, #alerts-production, or a service-specific incident channel.

Session owner

The session owner determines the Factory user identity used by the auto-run session. Choose an owner whose connected tools and organization permissions are appropriate for incident investigation.

If a session fails because the owner cannot be found or lacks access, update the channel settings to use a current user with the right permissions.

Machine target

The selected computer or workspace is where Droid runs the investigation. It should have:

• The relevant repositories available.
• Required package managers and CLIs installed.
• Authenticated access to observability, incident, and source-control systems.
• Safe permissions for the actions Droid may need to take during RCA.

Use Droid Computers when the incident workflow depends on a persistent environment with preconfigured tools.

Visibility and model

Private sessions are visible to the session owner. Organization-visible sessions can be reviewed by other members, which is useful for incident handoff and postmortem review.

Use the default model unless your team has a known preference for incident analysis. For complex production incidents, choose a stronger reasoning model if available.

How the incident flow works

Once configured, Incident Response follows this flow:

1. An alert bot posts a top-level message in the configured Slack channel.
2. Factory starts a Droid session using the channel’s owner, machine, visibility, model, and prompt.
3. Droid receives the Slack alert context and checks for any matching incident-guidelines runbook guidance.
4. Droid investigates with the configured tools and should invoke the /incident workflow when RCA is appropriate.
5. Factory posts status and session links back into Slack, and Droid can save reusable learnings for similar incidents.

The incident-guidelines runbook is stored locally at .factory/skills/incident-guidelines/SKILL.md for team reuse or ~/.factory/skills/incident-guidelines/SKILL.md for personal reuse. It should store reusable investigation guidance, not secrets or one-off RCA details.

Troubleshooting

The Slack channel does not appear in Factory

Invite Factory to the channel with /invite @Factory, then refresh the Slack settings or re-run /setup-incident-response. Private channels must invite Factory explicitly.

I cannot enable or edit channel settings

You need a Factory Manager or Owner role to configure Slack auto-run settings. Ask an org owner to update your role or perform the setup.

Auto-Run cannot be enabled

Make sure the channel has a selected computer or workspace. If none are available, create or connect a Droid computer first.

No session starts after a test message

Confirm the message is a top-level alert in the configured channel, not a thread reply. For the incident setup flow, alert bot messages are the expected trigger.

Droid starts but cannot investigate the issue

Check that the selected machine has the right repository, tooling, and credentials. Update the channel prompt with links to runbooks or dashboards Droid should use first.

The RCA is too generic

Add more channel-specific context to the prompt: service names, alert sources, dashboard links, log query examples, repository paths, and expected RCA format.

See also

• Slack integration — Connect Factory to Slack and invite Factory to channels.
• Autonomy Level — Understand how Droid runs work without repeated approvals.
• Droid Computers — Configure persistent environments for investigations.
• Skills — Learn how reusable workflows like incident investigation guide Droid.