In #incidents-prod, an on-call site reliability engineering (SRE) operator needs a short status and a route to the evidence. A long transcript is hard to scan; an “Incomplete” card without findings gives no next step.

The incident patterns below are composite and anonymized. Counts are rounded. Names, IDs, and infrastructure details are fictionalized to protect customer confidentiality.

What the channel needs

The diagram separates the facts on-call needs in the Slack card from detailed evidence and searchable conversation metadata elsewhere.

Investigation findings flow into a concise Slack triage card, with links to detailed evidence and authorized Activity search

Helps on-call

  • Headline counts (a compact KPI, or key-performance-indicator strip) and a priority summary that can be skimmed quickly
  • Numbered alert inventory with enough identity to open the right dashboard
  • Findings when root-cause analysis (RCA) is inconclusive — what was checked, what remains unknown
  • A link back to the watch page / session for the underlying evidence

Erodes trust

  • Dense Slack mrkdwn (Slack-formatted text) walls that bury the finding
  • “Incomplete” with no findings body
  • Activity rows (the product’s investigation history) that hide who started the thread and which Slack channel it came from

Slack Block Kit, the format for structured Slack messages, can carry a compact summary while a web dashboard holds the detail. Full parity is not necessary: the channel should contain the decision-relevant facts and a link to inspect the rest. Avoid posting sensitive raw logs into a broadly visible channel.

If you lead an SRE team

  • Review Slack cards with on-call: can a reader identify the alert, current finding, uncertainty, and next action without opening a transcript?
  • Distinguish “undetermined with findings” from a completed RCA; partial work is useful but does not resolve the incident
  • Make Activity answer “who started this?” and “which channel?” while respecting access controls

If you ship the agent platform

  • Render incident replies as compact structured blocks, not transcript dumps
  • Keep undetermined triage on a path that still emits findings-so-far
  • Index initiator and Slack thread metadata; support qualifier search (started_by:, channel tokens) only for viewers authorized to see those conversations

Acknowledgments. Slack triage UX lessons from shipping Aiden incident replies. Patterns composite.

If you are building AI for incident triage, Find me on GitHub or LinkedIn.

FAQ

What should an AI SRE post in Slack during triage?

A concise status with headline counts, numbered alert lines, findings even when the cause is undetermined, and a link to supporting evidence.

Should undetermined triage post nothing?

No. Undetermined is not empty. Operators need findings-so-far and what was checked. A bare Incomplete status does not tell on-call what was checked or what to do next.

What belongs in Activity search for incidents?

Initiator, Slack thread links, and qualifier search (who started it, which channel) so support can find the conversation without opening every row.