Incident War Rooms
Some incidents need a room, not another notification. A war room is a Slack or Microsoft Teams channel that belongs to one incident. KloudMate creates it, brings in the responders and the on-call engineers, posts an incident card at the top, and attaches a conference call link.
The card tracks the incident. It shows the current severity and status, and you can acknowledge, resolve, add responders, and leave a note from it without opening KloudMate.
An incident gets one room. If a routing rule, a Slack button, and the incident page all ask for a room in the same minute, you still end up with one channel.
Open a war room
Section titled “Open a war room”- From the incident. Click Start war room on the Incident War Room panel. You can change the channel name, paste a call link, and invite extra people before it opens.
- From Slack or Teams. Click Start war room on the incident alert in your shared channel.
- From a routing rule. Turn on Start War Room in the rule’s actions, and every incident it creates opens with a room.
- From an escalation step. Check Start War Room on this step, and the room opens when the incident escalates that far.
Both automatic paths are covered in Set up war rooms. KloudMate creates the room in the background, so it appears a few seconds after the incident, not instantly.
What responders see in Slack
Section titled “What responders see in Slack”The room opens as a private channel by default, and the first message is the incident card.
The card leads with the incident title as a link back to KloudMate, then the severity, status, and service. Below that it lists everyone who was invited. Anyone KloudMate couldn’t match to a Slack account is called out under Could not add, so you know to pull them in yourself. When the incident has a call link, the card carries a Join Call button, and a dial-in number when the call provider gives one.
The channel topic repeats the severity, the title, the link to the incident, and the call link. It’s there for whoever joins an hour in and scrolls to the top of nothing.
Act on the incident from the room
Section titled “Act on the incident from the room”The card’s buttons change with the incident:
| Button | What it does |
|---|---|
| Acknowledge / Unack | Acknowledges the incident, or takes the acknowledgement back. |
| Resolve / Unresolve | Resolves the incident, or reopens it. |
| Add Responders | Opens a picker of workspace members and attaches them to the incident. Each one is invited to the room. |
| Note | Opens a box for a note. It lands on the incident’s Notes tab with your name against it. |
| Run RCA | Starts an AI investigation for the incident. |
While an investigation runs, the card reads RCA Running. The findings arrive as a reply in the card’s thread, with a link to the full investigation, and the card switches to RCA Complete. If the investigation stalls, the card reads RCA Failed after 15 minutes and Run RCA comes back so you can try again.
KloudMate also replies in that thread as the incident moves: acknowledged or unacknowledged, resolved or reopened, assigned or unassigned, escalated, and re-notified, each stamped in UTC. The card and the topic are rewritten in place on every change, wherever the change came from. Resolve the incident in KloudMate and the Slack card follows.
What responders see in Microsoft Teams
Section titled “What responders see in Microsoft Teams”The room is a new standard channel in the team your war room channel belongs to, so everyone in that team can see it. The first post is the incident card, and KloudMate mentions the responders in the channel so Teams notifies them.
The card shows the severity, status, service, and responders, with links to View Incident and, when the incident has a call link, Join Call. Its buttons are Acknowledge (or Unack), Resolve (or Unresolve), Add Responders, and Note. Only a Developer can use Add Responders. A note is posted as a reply under the card and saved on the incident’s Notes tab. The card is rewritten in place as the incident changes, the same as in Slack.
The card also names responders KloudMate couldn’t bring in:
- Not in this team: they aren’t members of the team, so they can’t see the channel. A team owner has to add them to the team. KloudMate never adds people to a team.
- Not linked to Teams: KloudMate couldn’t match them to a Teams account yet. To link, they click a button on the card and choose Link my account. See Link your Teams account.
The incident alert turns into a pointer
Section titled “The incident alert turns into a pointer”Once a war room exists, the incident alert in the same app stops carrying its own buttons and becomes a signpost: Open war room and Open in KloudMate. A Slack room does this to the Slack alert, and a Teams room to the Teams alert. An alert in the other app keeps its buttons. The signpost isn’t rewritten again after that, so read the room’s card for the current state. That keeps the conversation in one place instead of splitting it between the alert thread and the room.
Follow the room from the incident page
Section titled “Follow the room from the incident page”The Incident War Room panel on the incident shows the room as Active, or as Archived (Slack) or Closed (Teams), links to the channel, and lists the members. A member KloudMate couldn’t match to a chat account is tagged Unmapped, and hovering it tells you why.
Conference call sits beside it. Use the edit icon to add or replace the Meeting link and the Dial-in at any point while the incident is open, and KloudMate updates the card, plus the channel topic in Slack. A Developer can also end the room early with Archive war room (Close war room for Teams), which posts the closing summary and closes the room straight away.
When the incident resolves
Section titled “When the incident resolves”KloudMate marks the card resolved, then starts the clock on the archive delay, which is one hour unless you’ve changed it. When the delay runs out, it posts a closing summary and closes the room.
- Slack: the channel is archived, and its history stays in your Slack workspace.
- Teams: the channel is renamed
closed-<name>and deleted 7 days later. Before that, KloudMate posts a record of the room in the incident’s alert thread in your shared Teams channel, with the AI resolution summary, so the summary outlives the channel. A team owner can restore a deleted channel in Teams for 30 days.
Set the delay to Keep the room open if you’d rather archive Slack rooms yourself. Teams rooms always need a delay, because every channel counts toward the team’s limit of 1,000 channels.
If you unresolve the incident inside the delay window, the room stays open while the incident is open, in Slack and in Teams. Resolving it again schedules another close. A close scheduled by the earlier resolve still runs at its original time, so the room can close sooner than the full delay after the second resolve.
Related
Section titled “Related”- Set up war rooms: what to connect, which permissions it needs, and the defaults for every room.
- Troubleshooting: what to do when a room won’t open or opens without a call.
- Slack Integration and Microsoft Teams Integration: the installs that war rooms use, and how people link their chat accounts.
- Routing Rules and Escalation Policies: the two places a room can open on its own.