---
title: "Your first incident"
description: "Declare, coordinate, and resolve an incident in Slack, end to end."
canonical: https://firefight.app/docs/getting-started/your-first-incident/
---

# Your first incident

This guide walks through the full life of an incident in Slack. You'll declare it, coordinate the response, and close it out. It assumes Firefight is already installed in your Slack workspace.

## Declare the incident

From any channel, type

```
/ff new
```

`/ff` is the short alias for `/firefight` and the two are interchangeable. You can also use the **Create an incident** shortcut from Slack's shortcuts menu.

A dialog opens asking for the essentials.

- **Name.** A short description of what's happening, like "Checkout returning 500s".
- **Severity.** How bad it is. Out of the box you choose from Critical, Major, or Minor.
- **Type.** What kind of incident it is, like Production or Security.

Your workspace may ask for more fields here, since admins can customize the declare form.

When you submit, Firefight creates a dedicated incident channel named after the date and your incident name, something like `#inc-2026-07-20-checkout-returning-500s`. It announces the incident to your team and posts a welcome message in the channel with the incident's details and quick actions. Everything from here on happens in that channel.

:::tip
Don't hesitate to declare. An incident that turns out to be nothing can be closed as a false positive in seconds. That's what the Canceled outcome is for. The expensive mistake is the real incident nobody declared.
:::

## Coordinate the response

Inside the incident channel, the `/ff` commands manage the incident. These are the ones you'll use most.

**Assign a lead.** Every incident needs one person who owns coordination.

```
/ff lead
```

**Post updates.** As the situation develops, keep the record current.

```
/ff update
```

This opens a dialog where you can change the status and severity and write an update, for example moving from Investigating to Identified once you know the cause. Updates are announced and added to the incident timeline, so people joining late can catch up without scrolling.

**Bring in help.** Invite teammates to the channel.

```
/ff invite
```

If you need people urgently, `/ff escalate` notifies them and asks for an acknowledgement, so you know whether help is actually on the way.

**Track action items.** When someone says "we should restart the worker pool", capture it before it's lost.

```
/ff action
```

Or react to their message with 💥 (`:boom:`) and Firefight turns that message into an action item. Actions have an owner and a status, and `/ff actions` lists where everything stands. For things that should happen after the incident, like "add an alert for this", use `/ff followup` or react with ▶️ (`:arrow_forward:`) instead.

**Catch up.** Joining an incident that's been running for an hour? `/ff timeline` shows the key events so far.

## Resolve it

When the issue is fixed and stable, type

```
/ff close
```

A dialog asks for closing details, then Firefight marks the incident resolved and announces it. If the problem comes back, `/ff reopen` picks up right where you left off, with the same channel and the same history.

## After the incident

Two things are worth doing while it's fresh.

- **Draft the postmortem.** `/ff postmortem` generates a first draft from the incident's timeline and channel discussion, ready to edit in the web dashboard. You review, refine, and fill in what only humans know.
- **Say thanks.** `/ff shoutout`, or reacting to someone's message with ❤️‍🔥 (`:heart_on_fire:`), recognizes a teammate who came through.

The incident, its timeline, actions, follow-ups, and postmortem all live on in the web dashboard, searchable whenever you need them.