{ "name": "12 - IT Incident Response & Alerting System", "nodes": [ { "id": "node-1", "name": "Webhook - Receive Alert", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "position": [240, 300], "parameters": { "httpMethod": "POST", "path": "incident-alert", "responseMode": "responseNode" } }, { "id": "node-2", "name": "Code - Parse & Enrich Alert", "type": "n8n-nodes-base.code", "typeVersion": 2, "position": [480, 300], "parameters": { "jsCode": "const a = $input.first().json;\nconst sMap = { P1:'critical', P2:'high', P3:'medium', P4:'low', critical:'critical', high:'high', warning:'medium', info:'low' };\nconst sev = a.severity || a.priority || a.level || 'P2';\nreturn [{ json: { incident_id: `INC-${Date.now()}`, title: a.title||a.monitor_name||'Alert Triggered', description: a.body||a.message||'No description', severity: sev, severity_label: sMap[sev]||'high', service: a.service||a.source||'unknown', environment: a.env||a.environment||'production', host: a.host||'unknown', alert_url: a.url||'', triggered_at: new Date().toISOString(), is_critical: ['P1','critical'].includes(sev) } }];" } }, { "id": "node-3", "name": "IF - Is Critical (P1)", "type": "n8n-nodes-base.if", "typeVersion": 2, "position": [720, 300], "parameters": { "conditions": { "conditions": [{ "id": "c1", "leftValue": "={{ $json.is_critical }}", "rightValue": true, "operator": { "type": "boolean", "operation": "true" } }], "combinator": "and" } } }, { "id": "node-4", "name": "Jira - Create Incident Ticket", "type": "n8n-nodes-base.jira", "typeVersion": 1, "position": [960, 140], "credentials": { "jiraSoftwareCloudApi": { "id": "YOUR_JIRA_CREDENTIAL_ID", "name": "Jira account" } }, "parameters": { "resource": "issue", "operation": "create", "project": "INC", "issuetype": "Incident", "summary": "=[{{ $json.severity }}] {{ $json.title }}", "additionalFields": { "description": "=Incident ID: {{ $json.incident_id }}\nService: {{ $json.service }}\nEnvironment: {{ $json.environment }}\nHost: {{ $json.host }}\nDescription: {{ $json.description }}", "priority": "={{ $json.severity_label === 'critical' ? 'Highest' : $json.severity_label === 'high' ? 'High' : 'Medium' }}", "labels": ["incident", "={{ $json.severity.toLowerCase() }}", "={{ $json.service }}"] } } }, { "id": "node-5", "name": "Slack - Broadcast Incident", "type": "n8n-nodes-base.slack", "typeVersion": 2.3, "position": [960, 300], "credentials": { "slackApi": { "id": "YOUR_SLACK_CREDENTIAL_ID", "name": "Slack account" } }, "parameters": { "resource": "message", "operation": "send", "channel": { "__rl": true, "value": "#incidents", "mode": "name" }, "text": "=šŸšØ *INCIDENT DETECTED*\n\n*{{ $json.title }}*\n\n*ID:* {{ $json.incident_id }}\n*Severity:* {{ $json.severity }} ā€” {{ $json.severity_label }}\n*Service:* {{ $json.service }}\n*Environment:* {{ $json.environment }}\n*Host:* {{ $json.host }}\n*Time:* {{ $json.triggered_at }}\n\n*Description:* {{ $json.description }}\n\nāœ… Jira ticket created | āœ… On-call paged", "otherOptions": {} } }, { "id": "node-6", "name": "HTTP - Page PagerDuty", "type": "n8n-nodes-base.httpRequest", "typeVersion": 4.2, "position": [960, 460], "parameters": { "method": "POST", "url": "https://events.pagerduty.com/v2/enqueue", "sendHeaders": true, "headerParameters": { "parameters": [ { "name": "Authorization", "value": "Token token=YOUR_PAGERDUTY_API_KEY" }, { "name": "Content-Type", "value": "application/json" } ] }, "sendBody": true, "specifyBody": "json", "jsonBody": "={\n \"routing_key\": \"YOUR_PAGERDUTY_ROUTING_KEY\",\n \"event_action\": \"trigger\",\n \"dedup_key\": \"{{ $json.incident_id }}\",\n \"payload\": {\n \"summary\": \"[{{ $json.severity }}] {{ $json.title }}\",\n \"severity\": \"{{ $json.severity_label }}\",\n \"source\": \"{{ $json.service }}\",\n \"component\": \"{{ $json.host }}\",\n \"group\": \"{{ $json.environment }}\"\n }\n}" } }, { "id": "node-7", "name": "Jira - Create Standard Bug (Non-P1)", "type": "n8n-nodes-base.jira", "typeVersion": 1, "position": [960, 620], "credentials": { "jiraSoftwareCloudApi": { "id": "YOUR_JIRA_CREDENTIAL_ID", "name": "Jira account" } }, "parameters": { "resource": "issue", "operation": "create", "project": "OPS", "issuetype": "Bug", "summary": "=[{{ $json.severity }}] {{ $json.title }}", "additionalFields": { "description": "={{ $json.description }}", "priority": "Medium", "labels": ["monitoring", "={{ $json.service }}"] } } }, { "id": "node-8", "name": "Respond - Acknowledged", "type": "n8n-nodes-base.respondToWebhook", "typeVersion": 1, "position": [1200, 300], "parameters": { "respondWith": "json", "responseBody": "={\n \"status\": \"acknowledged\",\n \"incident_id\": \"{{ $json.incident_id }}\"\n}" } }, { "id": "node-9", "name": "Webhook - Post-Mortem Trigger", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "position": [240, 700], "parameters": { "httpMethod": "POST", "path": "incident-resolved", "responseMode": "responseNode" } }, { "id": "node-10", "name": "OpenAI - Generate Post-Mortem", "type": "n8n-nodes-base.openAi", "typeVersion": 1.8, "position": [480, 700], "credentials": { "openAiApi": { "id": "YOUR_OPENAI_CREDENTIAL_ID", "name": "OpenAI account" } }, "parameters": { "resource": "chat", "operation": "complete", "modelId": { "__rl": true, "value": "gpt-4o", "mode": "list", "cachedResultName": "gpt-4o" }, "messages": { "values": [ { "role": "system", "content": "You are an SRE writing a blameless post-mortem. Be thorough and actionable." }, { "role": "user", "content": "=Write a post-mortem for: Incident={{ $json.incident_id }}, Title={{ $json.title }}, Service={{ $json.service }}, Duration={{ $json.duration_minutes }} minutes, Root Cause={{ $json.root_cause }}, Impact={{ $json.impact }}. Include: Summary, Timeline, Root Cause, Impact, Action Items." } ] }, "options": { "temperature": 0.3 } } }, { "id": "node-11", "name": "Gmail - Email Post-Mortem", "type": "n8n-nodes-base.gmail", "typeVersion": 2.1, "position": [720, 700], "credentials": { "gmailOAuth2": { "id": "YOUR_GMAIL_CREDENTIAL_ID", "name": "Gmail account" } }, "parameters": { "resource": "message", "operation": "send", "sendTo": "engineering@yourcompany.com, cto@yourcompany.com", "subject": "=Post-Mortem: {{ $('Webhook - Post-Mortem Trigger').item.json.title }}", "message": "={{ $input.first().json.message.content }}", "options": {} } }, { "id": "node-12", "name": "Respond - Post-Mortem Sent", "type": "n8n-nodes-base.respondToWebhook", "typeVersion": 1, "position": [960, 700], "parameters": { "respondWith": "json", "responseBody": "{ \"status\": \"post_mortem_sent\" }" } } ], "connections": { "Webhook - Receive Alert": { "main": [[{ "node": "Code - Parse & Enrich Alert", "type": "main", "index": 0 }]] }, "Code - Parse & Enrich Alert": { "main": [[{ "node": "IF - Is Critical (P1)", "type": "main", "index": 0 }]] }, "IF - Is Critical (P1)": { "main": [ [{ "node": "Jira - Create Incident Ticket", "type": "main", "index": 0 }, { "node": "Slack - Broadcast Incident", "type": "main", "index": 0 }, { "node": "HTTP - Page PagerDuty", "type": "main", "index": 0 }], [{ "node": "Jira - Create Standard Bug (Non-P1)", "type": "main", "index": 0 }] ] }, "Jira - Create Incident Ticket": { "main": [[{ "node": "Respond - Acknowledged", "type": "main", "index": 0 }]] }, "Jira - Create Standard Bug (Non-P1)": { "main": [[{ "node": "Respond - Acknowledged", "type": "main", "index": 0 }]] }, "Webhook - Post-Mortem Trigger": { "main": [[{ "node": "OpenAI - Generate Post-Mortem", "type": "main", "index": 0 }]] }, "OpenAI - Generate Post-Mortem": { "main": [[{ "node": "Gmail - Email Post-Mortem", "type": "main", "index": 0 }]] }, "Gmail - Email Post-Mortem": { "main": [[{ "node": "Respond - Post-Mortem Sent", "type": "main", "index": 0 }]] } }, "settings": { "executionOrder": "v1" }, "active": false, "tags": [{ "name": "Portfolio" }, { "name": "DevOps" }, { "name": "Incident Management" }] }