Your first incident

This guide walks through the full life of an incident in Slack. You’ll declare it, coordinate the response, and close it out. It assumes Firefight is already installed in your Slack workspace.

Try it with a test incident

A test incident gets a channel, an announcement and a postmortem like any other, and is not counted in your metrics. Three places offer Declare a test incident:

• The last step of setup. Its declare form opens already filled in, so pressing Declare is enough.
• The welcome message in #incidents, until a test incident is declared.
• The dashboard, if you connected Slack after setup. Whoever created the workspace sees Three steps to see how Firefight works on the incidents page, with Declare a test incident, Open #incidents instead and Not now. Not now stops it showing, on every device.

The welcome message and the dashboard open the declare form empty, so you name the test incident yourself.

The guide in the channel

Your workspace’s first test incident comes with a short guide in its channel. It is the newest message when you open the channel. Each step appears as you finish the one before.

Step	What it asks
1 of 4	Make yourself the lead, with Make me Lead or /ff lead
2 of 4	Post a few messages about what is happening, since the postmortem is drafted from them. It offers three lines you can paste
3 of 4	Resolve the incident, with Resolve or /ff resolve
4 of 4	Click Write the postmortem on the resolution message, or run /ff postmortem

Once the postmortem is written, a last message says that is the whole loop and suggests sharing #incidents with your team.

Declare the incident

From any channel, type

/ff new

/ff is the short alias for /firefight and the two are interchangeable. You can also use the Create an incident shortcut from Slack’s shortcuts menu or the Declare incident button on the dashboard.

A dialog opens asking for the essentials.

• Incident name. A short description of what’s happening, like “Checkout returning 500s”.
• Severity. How bad it is. Out of the box you choose from Critical, Major, or Minor.
• Summary. Optional. What you know so far and the impact it is having.

Your workspace may ask for more here, such as the incident type or whether the incident is private, since admins can customize the declare form. See Incident forms.

When you submit, Firefight creates a dedicated incident channel named after the date and your incident name, something like #inc-2026-07-20-checkout-returning-500s. Everything from here on happens in that channel.

Firefight also announces the incident to your team in your incidents channel, as one card. The card leads with the incident’s ID and name, such as INC-12 · Checkout returning 500s, then its state on one line, such as “Major · Investigating · Lead @Dana”, then the summary. It carries Join channel, Subscribe and Open in Firefight, and says who declared it underneath. A test incident also says it is not counted in your metrics. The card keeps itself up to date as the incident changes, and updates about the incident are posted in its thread.

In the incident channel, Firefight pins a message with the same name, state and summary, and the quick actions you need most:

Button	When it shows
Accept incident and Cancel incident	While the incident is still in triage
Make me Lead	Until the incident has a lead
Update summary	Always
Investigate	When Halon can investigate in your workspace
Escalate and Resolve	Always

Once the incident is resolved or canceled, the pinned message keeps its details and drops the buttons.

Anyone who wants to follow along without joining the channel can click Subscribe on the announcement. Firefight then sends them a short direct message for every update about the incident. See Follow an incident without joining it.

Tip

Don’t hesitate to declare. An incident that turns out to be nothing can be closed as a false positive in seconds. That’s what the Canceled outcome is for. The expensive mistake is the real incident nobody declared.

Coordinate the response

Inside the incident channel, the /ff commands manage the incident. These are the ones you’ll use most.

Assign a lead. Every incident needs one person who owns coordination.

/ff lead

Run /ff roles instead to fill every incident role at once, lead included.

Post updates. As the situation develops, keep the record current.

/ff update

This opens a dialog that starts with the update itself, what is happening and what you are doing next, then lets you change the status and severity alongside it, for example moving from Investigating to Identified once you know the cause. You can also say when the next update is due, and Firefight nudges the lead in the channel when that time arrives, so a quiet incident does not drift. Updates are announced and added to the incident timeline, so people joining late can catch up without scrolling.

Bring in help. Invite teammates to the channel.

/ff invite

If you need people urgently, /ff escalate notifies them and asks for an acknowledgement, so you know whether help is actually on the way.

Track action items. When someone says “we should restart the worker pool”, capture it before it’s lost.

/ff action

Or react to their message with 💥 (:boom:) and Firefight turns that message into an action item. Actions have an owner and a status, and /ff actions lists where everything stands. For things that should happen after the incident, like “add an alert for this”, use /ff followup or react with ▶️ (:arrow_forward:) instead.

Catch up. Joining an incident that’s been running for an hour? /ff timeline shows the key events so far.

Resolve it

When the issue is fixed and stable, click Resolve on the pinned message at the top of the incident channel, or type

/ff resolve

/ff close does the same thing. A dialog asks for closing details, then Firefight marks the incident resolved and announces it. The resolution message says who resolved it and how long it took, such as “Resolved by @Dana after 1h 12m”, then the summary and the severity. In the incident channel it also offers a Write the postmortem button, with a line saying how many of the channel’s messages the draft is written from. If the problem comes back, /ff reopen picks up right where you left off, with the same channel and the same history.

After the incident

Two things are worth doing while it’s fresh.

• Draft the postmortem. Click Write the postmortem on the resolution message, or run /ff postmortem. Firefight drafts it from the timeline and the channel messages, ready to edit in the web dashboard. Anything it was not told is left for you to fill in, never made up.
• Say thanks. /ff shoutout, or reacting to someone’s message with ❤️‍🔥 (:heart_on_fire:), recognizes a teammate who came through.

The incident, its timeline, actions, follow-ups, and postmortem all live on in the web dashboard, searchable whenever you need them.