What's new in FireFight

Your team's "here's what to do when this breaks" knowledge now lives in Firefight, and shows up exactly when it applies.

Structured procedures. A runbook has a summary, a rich procedure written in a formatting editor and stored as Markdown, an optional external link, and an ordered list of steps. Manage them at Settings → Runbooks.

Automatic attachment. Conditions decide which incidents a runbook applies to: incident type, severity, and custom fields, including catalog references like the affected service. Conditions are evaluated at declaration and re-evaluated on every update, so a runbook scoped to a service attaches the moment that field is set.

From checklist to actions. Attached runbooks post into the incident channel with their steps and an Add steps as actions button. One press creates an action item per step, assignable and trackable like any other.

Built for AI agents. Attached runbooks are part of the incident context Firefight's AI sees, and connected agents can browse them over MCP with two new read-only tools, search_runbooks and get_runbook. The REST API exposes the same data at GET /api/v1/runbooks under a new runbooks permission resource.

On the record. New runbook.attached and runbook.applied timeline events, both available to outbound webhooks.

Run the entire incident from Slack. Declare with /firefight and FireFight sets up the incident and its channel for you.

From there you can:

• Set severity and status inline
• Assign a lead and pull in responders
• Escalate when it's stuck, and acknowledge when someone picks it up
• Close it, or reopen it if it comes back

FireFight manages the incident channel through the whole lifecycle: created when you declare, kept current as things change, and archived on close.

FireFight puts AI on the busywork around an incident:

• Postmortems are drafted from the timeline, then you edit them
• Catch me up summarizes the incident for anyone who just joined
• Live summaries keep the current state accurate without anyone maintaining it

The AI layer is model-agnostic, so you're not tied to a single provider.

You don't stop firefighting to log what happened. React to a message and FireFight captures it:

• Turn a message into a tracked action item
• Capture a follow-up for after the incident is over
• Give a teammate a shoutout in the moment they earned it

The timeline builds itself out of how your team already communicates.

Slack is where you run incidents. The dashboard is where you understand them.

• Filter incidents by severity, status and search
• See stats including MTTR across your workspace
• Open any incident for its full timeline and audit trail

Configure FireFight to match how your team works:

• A service catalogue with typed attributes and relationships between entries
• Custom fields on incidents
• Configurable incident forms, types and roles

Bring incidents in from the rest of your stack. The REST API at /api/v1 covers:

• Creating and updating incidents, with a source so you know where each one came from
• Reading severities, statuses and incident types
• Reading and writing the catalogue

Authentication is Bearer-token via API keys with per-resource permissions, and incident creation is idempotent, so retries never create duplicates.

Subscribe your own services to incident events. Deliveries are signed and timestamped, and failed deliveries are retried automatically, with delivery tracking so you can see exactly what was sent and when.

Every incident has a dedicated page in the dashboard showing its timeline, its actions and follow-ups, and its postmortem, alongside the activity happening in Slack.

Files and screenshots shared in the incident channel are rendered inline in the incident timeline, so the visual context of what happened stays with the record.

If you belong to more than one workspace running FireFight, you can switch between them from a single account without signing out.

FireFight is open source under AGPL-3.0. Self-host it on your own infrastructure, keep your incident data inside your own perimeter, and point the AI layer at your own model. Because the codebase is open, your security team can read exactly what it does instead of taking our word for it.