Slack command reference

Firefight registers two identical slash commands, /firefight and its short alias /ff. These docs use /ff. Most commands act on the incident whose channel you run them in, so unless noted otherwise, run them inside an incident channel.

Most of what these commands do can also be done from the incident’s page in the dashboard, using the same dialogs. See Running an incident from the dashboard.

Work from anywhere

Command	What it does
/ff new	Declare a new incident. Opens the declare dialog, then creates the incident channel.
/ff list	List the incidents that are currently live.
/ff home	Open the Firefight home dialog, an overview with quick actions for common tasks. /ff on its own does the same thing.
/ff investigate	Start Halon on a problem. In an incident channel it investigates the incident. Anywhere else, say what is wrong after the command, such as /ff investigate checkout 500s since 2pm, and Halon answers in that channel.

Run the response

Command	What it does
/ff lead	Assign the incident lead.
/ff roles	Assign every incident role in one dialog, one person each. /ff role does the same thing.
/ff status	Change the incident’s status. Opens the same dialog as /ff update.
/ff severity	Change the incident’s severity. Opens the same dialog as /ff update.
/ff update	Post an incident update. One dialog covers status, severity, a written summary of where things stand, and when the next update is due.
/ff summary	Edit the incident’s summary.
/ff invite	Invite teammates into the incident channel.
/ff escalate	Urgently notify people and request an acknowledgement, so you know help is coming.

Track the work

Command	What it does
/ff actions	List the incident’s action items, things to do now as part of the response, with + Add new action to create one. /ff action does the same thing.
/ff followups	List the incident’s follow-ups, things to do after the incident is over, with + Add new follow-up to create one. /ff followup does the same thing.
/ff runbook	Attach a runbook to this incident, picking from the ones not already on it. /ff runbooks does the same thing.
/ff timeline	Show the incident’s timeline of key events.
/ff catchup	Get an AI-written summary of the incident so far, useful when joining late.

Every action item and follow-up is posted in the channel with its own controls. I can take this assigns it to you, Mark as done closes it out, and the person picker beside them hands it to someone else at any point before it is done. Rename opens a form to change what it says, and Unassign lets go of it while someone holds it. Once it is done, its message offers Reopen. Handing one over posts it again naming the new holder, so they can work it where they were told about it. The same controls sit on every row in /ff actions and /ff followups, so you can work the whole list from one screen.

Completing anything posts a short line saying what was finished and who finished it, linking back to where it came from. Work spread across an incident is easy to miss otherwise, because a finished item only strikes itself through in place and Slack does not announce an edit.

Connect incidents

Command	What it does
/ff link	Link this incident to another one as related. /ff relate does the same thing.
/ff duplicate	Mark this incident as a duplicate of another. This one is canceled and points at the other.

Wrap up

Command	What it does
/ff close	Close the incident. /ff resolve does the same thing.
/ff cancel	Cancel an incident that turned out not to be one.
/ff reopen	Reopen a resolved or canceled incident with the same channel and history. /ff open does the same thing.
/ff postmortem	Generate an AI-drafted postmortem from the incident’s timeline and discussion, ready to edit in the dashboard.
/ff shoutout	Recognize a teammate who came through during the incident.

Reaction shortcuts

Inside an incident channel, reacting to any message turns it into a record. No command needed. Firefight asks first, in a note only you can see, and its button opens the form. For an action item or a follow-up the form is already filled in from the message, so you can adjust it before saving.

Reaction	What it does
💥 :boom:	Turn the message into an action item.
▶️ :arrow_forward:	Turn the message into a follow-up.
❤️‍🔥 :heart_on_fire:	Give the message’s author a shoutout.

Mention the bot

In an active incident’s channel, mention @Firefight in a message to ask Halon about the incident. Halon answers in a thread under your message, from the incident’s record and your connected tools, and you follow up by mentioning it again in that thread. See Chatting with Halon.

Halon puts an eyes reaction on your message while it works on it, and swaps it for a check mark once the answer is in. If Halon cannot answer, for example because you lack the permission, it tells you in a message only you can see, in the thread and in your direct messages, and takes the eyes away.

Start the message with investigate, such as @Firefight investigate checkout is slow, to start an investigation instead, the same as /ff investigate. This works in any channel, not just an incident’s. Mentioning @Firefight in the thread of an investigation that is still running adds what you wrote to the run, which reads it at its next step.