Your first incident

This guide walks through the full life of an incident in Slack. You’ll declare it, coordinate the response, and close it out. It assumes Firefight is already installed in your Slack workspace.

Try it with a test incident

Right after installing, the welcome message in #incidents and the dashboard both offer Declare a test incident. A test incident gets a channel, an announcement and a postmortem like any other, and is not counted in your metrics. Firefight posts the next step in its channel as you go, so you never have to guess what to do.

Declare the incident

From any channel, type

/ff new

/ff is the short alias for /firefight and the two are interchangeable. You can also use the Create an incident shortcut from Slack’s shortcuts menu or the Declare incident button on the dashboard.

A dialog opens asking for the essentials.

• Name. A short description of what’s happening, like “Checkout returning 500s”.
• Severity. How bad it is. Out of the box you choose from Critical, Major, or Minor.
• Type. What kind of incident it is, like Production or Security.

Your workspace may ask for more fields here, since admins can customize the declare form.

When you submit, Firefight creates a dedicated incident channel named after the date and your incident name, something like #inc-2026-07-20-checkout-returning-500s. It announces the incident to your team and posts a welcome message in the channel with the incident’s details and quick actions. Everything from here on happens in that channel.

Anyone who wants to follow along without joining the channel can click Subscribe on the announcement. Firefight then sends them every update it posts about the incident as a direct message. See Follow an incident without joining it.

Tip

Don’t hesitate to declare. An incident that turns out to be nothing can be closed as a false positive in seconds. That’s what the Canceled outcome is for. The expensive mistake is the real incident nobody declared.

Coordinate the response

Inside the incident channel, the /ff commands manage the incident. These are the ones you’ll use most.

Assign a lead. Every incident needs one person who owns coordination.

/ff lead

Run /ff roles instead to fill every incident role at once, lead included.

Post updates. As the situation develops, keep the record current.

/ff update

This opens a dialog that starts with the update itself, what is happening and what you are doing next, then lets you change the status and severity alongside it, for example moving from Investigating to Identified once you know the cause. You can also say when the next update is due, and Firefight nudges the lead in the channel when that time arrives, so a quiet incident does not drift. Updates are announced and added to the incident timeline, so people joining late can catch up without scrolling.

Bring in help. Invite teammates to the channel.

/ff invite

If you need people urgently, /ff escalate notifies them and asks for an acknowledgement, so you know whether help is actually on the way.

Track action items. When someone says “we should restart the worker pool”, capture it before it’s lost.

/ff action

Or react to their message with 💥 (:boom:) and Firefight turns that message into an action item. Actions have an owner and a status, and /ff actions lists where everything stands. For things that should happen after the incident, like “add an alert for this”, use /ff followup or react with ▶️ (:arrow_forward:) instead.

Catch up. Joining an incident that’s been running for an hour? /ff timeline shows the key events so far.

Resolve it

When the issue is fixed and stable, click Resolve on the pinned message at the top of the incident channel, or type

/ff resolve

/ff close does the same thing. A dialog asks for closing details, then Firefight marks the incident resolved and announces it. The resolution message offers a Write the postmortem button. If the problem comes back, /ff reopen picks up right where you left off, with the same channel and the same history.

After the incident

Two things are worth doing while it’s fresh.

• Draft the postmortem. Click Write the postmortem on the resolution message, or run /ff postmortem. Firefight drafts it from the timeline and the channel messages, ready to edit in the web dashboard. Anything it was not told is left for you to fill in, never made up.
• Say thanks. /ff shoutout, or reacting to someone’s message with ❤️‍🔥 (:heart_on_fire:), recognizes a teammate who came through.

The incident, its timeline, actions, follow-ups, and postmortem all live on in the web dashboard, searchable whenever you need them.