Incident Response

Set up Droid to respond to production alerts in Slack and resolve or investigate incidents autonomously.

Overview

When an alert lands in a configured Slack channel, Factory automatically starts a linked Droid session so Droid can investigate the incident with the right context, machine, and instructions.

Droid can work toward an RCA, open a PR for a fix when appropriate, and update an incident runbook so future investigations of the same alert type start faster.

Configuring Factory channel auto-run requires a Factory Owner or Manager role.

Quickstart: set up from the Factory App

Use the web UI when you want to review all Slack channel settings in one place.

1. Open the Slack Channels settings

   In the Factory App, go to Settings → Integrations → Slack. If you have not connected Slack yet, set up the Slack integration first, then open the Slack management view and select the Channels tab.

2. Invite Factory to the incident channel

   In Slack, open the channel where alert bots post incidents and run:

   /invite @Factory
   

   Only channels where Factory has been invited appear in the channel list.

3. Enable Auto-Backlink for the channel

   In Select Auto-Backlinked Channels, search for the incident channel and turn on Auto-Backlink. This links Slack messages in that channel back to Factory sessions and expands the channel settings.

4. Choose who the channel runs as

   If the Run as row appears, leave it set to Factory user or select a service account. Service accounts use their own computers and run identity, so choose one when you want incident sessions to run from a shared, preconfigured account.

5. Choose the session target

   Select the Machine Type and target Droid should use. Most orgs use Computer; some orgs can choose Cloud or Computer. If you select a service account, Machine Type is locked to Computer and the Computer picker only shows computers owned by that service account.

6. Turn on Auto-Run

   Enable Auto-Run. This lets Factory start a Droid session automatically when an incident alert arrives. If Auto-Run cannot be enabled, select or create the required computer or workspace first.

7. Tune visibility, model, and prompt

   Choose the session owner when using Factory user, set whether sessions are private or visible to the organization, optionally select a model, and set the custom incident prompt.

   A good starting prompt is:

   Use the `/incident` skill for Slack incidents and run an RCA if applicable.
   If the thread message is an incident or asking for RCA/root-cause analysis, invoke the `incident` skill before investigating.
   
8. Send a test alert

   Post a test top-level alert from the same kind of bot that will send real incidents. Confirm Factory starts an auto-run Droid session and links it from the Slack thread.

Alternative: Set up with Droid CLI

Use the CLI flow when you are already in Droid and want a guided incident-channel setup.

1. Run the setup command

   In the Droid CLI, run:

   /setup-incident-response
   

   If Slack is not connected yet, Droid opens the Slack OAuth flow before continuing.

2. Select the incident channel

   Choose the Slack channel that receives incident alerts. If the channel is missing, invite Factory to it with /invite @Factory and run the setup command again.

3. Select the computer

   Choose the computer Droid should use for incident investigations. Pick the environment with the right repository checkout, observability tools, and credentials.

4. Accept or edit the RCA prompt

   Keep the default incident prompt or add channel-specific instructions, such as which runbooks, dashboards, repositories, or escalation rules Droid should check first.

5. Apply and verify

   Confirm the setup, then send a test alert in Slack to verify that Droid starts automatically.

Configuration details

Customizing the prompt

The channel prompt is injected into every auto-run session for that channel. Keep it specific to incident work:

• Tell Droid to run RCA and use the /incident workflow when appropriate.
• Mention the primary services or repositories for that channel.
• Point Droid at runbooks, dashboards, or common alert sources.
• State escalation expectations, such as when to summarize uncertainty instead of taking action.

Avoid prompts that make the channel a general-purpose automation surface. Incident Response works best when the prompt is narrow and operational.

Channel selection

Incident Response is designed for channels where incident alerts arrive as top-level messages. Thread replies are not used to start new auto-run sessions, which prevents ordinary discussion from repeatedly launching Droids.

For best results, use a dedicated channel such as #incidents, #alerts-production, or a service-specific incident channel.

The Slack Channels settings table only shows channels where Factory has been invited. Enable Auto-Backlink for the channel first, then expand the row to configure Auto-Run.

Run as

The Run as picker appears when service account channel delegation is available for your organization.

• Factory user uses the configured session owner for Auto-Run sessions.
• A service account uses that service account’s identity and computers.

When a service account is selected, Factory locks Machine Type to Computer, hides the session owner row, and limits the computer picker to computers owned by that service account. Use this for shared incident-response setups where the channel should always run from the same preconfigured account and machine.

Session owner

When Run as is set to Factory user, the session owner determines the Factory user identity used by the Auto-Run session. Choose an owner whose connected tools and organization permissions are appropriate for incident investigation.

If a session fails because the owner cannot be found or lacks access, update the channel settings to use a current user with the right permissions.

Machine target

The selected computer or workspace is where Droid runs the investigation. In the channel settings, choose Machine Type, then select the target Computer or Workspace. Auto-Run requires a selected target before it can be enabled.

The target should have:

• The relevant repositories available.
• Required package managers and CLIs installed.
• Authenticated access to observability, incident, and source-control systems.
• Safe permissions for the actions Droid may need to take during RCA.

Use Droid Computers when the incident workflow depends on a persistent environment with preconfigured tools.

If you select a Bring Your Own Machine (BYOM) computer, Factory warns that session output, including machine information, may be posted back to the Slack channel.

Visibility and model

Private sessions are visible to the session owner. Organization-visible sessions can be reviewed by other members, which is useful for incident handoff and postmortem review.

Use the default model unless your team has a known preference for incident analysis. For complex production incidents, choose a stronger reasoning model if available.

How the incident flow works

Once configured, Incident Response follows this flow:

1. An alert bot posts a top-level message in the configured Slack channel.
2. Factory starts a Droid session using the channel’s run identity, target machine, visibility, model, and prompt.
3. Droid receives the Slack alert context and checks for any matching incident-guidelines runbook guidance.
4. Droid investigates with the configured tools and should invoke the /incident workflow when RCA is appropriate.
5. Factory posts status and session links back into Slack, and Droid can save reusable learnings for similar incidents.

The incident-guidelines runbook is stored locally at .factory/skills/incident-guidelines/SKILL.md for team reuse or ~/.factory/skills/incident-guidelines/SKILL.md for personal reuse. It should store reusable investigation guidance, not secrets or one-off RCA details.

Troubleshooting

The Slack channel does not appear in Factory

Invite Factory to the channel with /invite @Factory, then refresh the Slack settings or re-run /setup-incident-response. Private channels must invite Factory explicitly.

I cannot enable or edit channel settings

You need a Factory Manager or Owner role to configure Slack auto-run settings. Ask an org owner to update your role or perform the setup.

Auto-Run cannot be enabled

Make sure the channel has a selected computer or workspace. If Run as is set to a service account, that service account must own at least one computer.

No session starts after a test message

Confirm the message is a top-level alert in the configured channel, not a thread reply. For the incident setup flow, alert bot messages are the expected trigger.

Droid starts but cannot investigate the issue

Check that the selected machine has the right repository, tooling, and credentials. Update the channel prompt with links to runbooks or dashboards Droid should use first.

The RCA is too generic

Add more channel-specific context to the prompt: service names, alert sources, dashboard links, log query examples, repository paths, and expected RCA format.

See also

• Slack integration — Connect Factory to Slack and invite Factory to channels.
• Autonomy Level — Understand how Droid runs work without repeated approvals.
• Droid Computers — Configure persistent environments for investigations.
• Skills — Learn how reusable workflows like incident investigation guide Droid.