ChatOps (Slack / Discord)

Add webhook URL refs to the tenant config. Each channel supports a severity_filter and a dedup_window_seconds (default 300s).

notifications:
  enabled: true
  channels:
    - provider: slack
      webhook_url_ref: "kv:secrets/slack-acme"
      severity_filter: ["critical", "high"]
      label: "#incidents"
    - provider: discord
      webhook_url_ref: "kv:secrets/discord-acme"
      severity_filter: ["critical"]

ChatOps uses Slack Block Kit and Discord Embeds with the diagnosis, actions and a resolve button.

Ticketing (Zoho Desk / Jira / ServiceNow)

createTicketFromTriage dispatches to the tenant’s provider:

Provider	Auth	Notes
Zoho Desk	OAuth refresh token	default
Jira Cloud	email + API token	instance_url, project_key, issue_type
ServiceNow	username + password	table, assignment_group

ticketing:
  enabled: true
  provider: jira
  instance_url: https://acme.atlassian.net
  project_key: SOC
  issue_type: Incident
  auth_email: soc@acme.com
  auth_token: <token>

Ticket creation is non-blocking — a failure logs ticket_failed and never breaks the incident pipeline.

Escalation (SLA)

The cron (every 5 min) escalates unacknowledged incidents past their SLA:

escalation:
  - after_minutes: 5
    action: notify_oncall
  - after_minutes: 15
    action: page_oncall

On-Call rotation (R-020)

• Schedules in D1, POST /oncall CRUD.
• GET /oncall/current → who is on call now.
• Escalation resolves the on-call override first, then schedule, then team default.
• UI widget in the dashboard shows current on-call.

oncall:
  notification_method: webhook

End-to-end flow

ingest → parse → enriched → LLM triage
   → notified (Slack/Discord) → ticket (Zoho/Jira/SN)
   → cron: unacked past SLA → escalation → on-call page
   → operator: /acknowledge → /resolve → MTTR tracked