Incident response
Slack commands
Ask who is on call, acknowledge an incident, or pull someone in — without leaving Slack.
Once your workspace is connected, you can type WarnFire commands anywhere in Slack.
Use /warnfire or /wf — they’re the same command, so use whichever you can type faster at three in the morning.
The commands arrive with the app. After an administrator reconnects or
reinstalls WarnFire, reload Slack once to refresh its command autocomplete
list. If /warnfire changes into /wf when you press Enter, the workspace is
still using an older installation; ask an administrator to reinstall WarnFire.
The commands
| Type this | What happens |
|---|---|
/wf help | Lists everything below. Typing just /wf does the same. |
/wf oncall | Who is carrying the pager right now. |
/wf oncall payments | Only the rotations matching that team or schedule name. |
/wf ack | Acknowledge this channel’s incident. Paging stops — you own it. |
/wf resolve | Resolve this channel’s incident. |
/wf note the database has failed over | Add a note to the incident timeline. |
/wf invite @ada | Ask someone to join this incident. |
/wf page checkout payments are timing out | Open a new incident and page that service’s on-call. |
ack, resolve, note and invite work inside an incident channel, where the channel tells WarnFire which incident you mean. Anywhere else they’ll say so rather than guess.
A few commands accept aliases if they are easier to remember: on-call or who for oncall, acknowledge for ack, and close for resolve.
Who can use them
help (and a bare /wf) works for anyone in the workspace, whether or not
they are linked. oncall and page need your Slack account linked to an
enabled WarnFire responder. Linking usually happens automatically the first
time the responder is paged into an incident channel.
ack, resolve, note, and invite have a narrower rule: the linked responder
must be one of the responders captured from the incident’s escalation plan.
WarnFire does not grant those commands merely because someone joined the Slack
channel or accepted an assistance invitation.
If you are not linked, WarnFire tells you how to fix the link rather than failing silently. If an incident needs immediate action and no authorized Slack responder is available, a tenant owner or tenant administrator can use the WarnFire console to acknowledge or resolve it, then correct the responder or escalation configuration before the next incident.
/wf oncall
The answer is posted in the channel, not just to you — the question was asked in the open, so everyone reading benefits.
If a rotation has nobody on call, it says so plainly rather than leaving a blank. That gap is usually the most important thing on the list.
/wf invite
The request is posted in the channel so the room knows help is coming and nobody duplicates the ask.
Mentioning a person with @ is the safest form because it identifies one Slack
account. A one-word responder or team name can be entered directly. Put a
multiword full name in double quotes:
/wf invite "Database Owners" we need the database owner
WarnFire prefers a unique case-insensitive exact name. If a prefix matches more than one responder or team, it refuses to guess and asks for the exact name or a Slack mention.
You can add a reason, which goes to them with the request:
/wf invite @ada we need the database owner
They’re paged on their own devices and added to the incident channel when they accept. Acceptance makes them an incident participant; it does not add them to the incident’s captured escalation responders or grant the Slack incident commands described above.
/wf page
This opens a real incident and pages people. It takes a service name and a description of what’s wrong:
/wf page checkout payments are timing out
Use double quotes around a multiword service name:
/wf page "Checkout API" payments are timing out
WarnFire prefers a unique case-insensitive exact service name. A unique prefix also works, but an ambiguous prefix is rejected instead of selecting the first service alphabetically.
WarnFire pages whoever is on call for that service, following its escalation policy exactly as if a monitoring system had reported it.
This is production paging, not a dry run. Notify the responder before testing. Every selected SMS and voice destination consumes its allowance or prepaid credits, and low balances can invoke an already active automatic-recharge policy .
It targets a service rather than a person, because a service is what has an on-call rotation and an escalation path behind it. To bring a specific person into something already running, use /wf invite.
Good to know
ackandresolvereply only to you. WarnFire announces the change to the channel separately, so it isn’t said twice.- Everything done through a command is recorded on the incident timeline with your name and the time, exactly like an action taken in the app.