Most incidents are declared by a human noticing something. Auto-create lets Warrn do it for you in the cases where the signal is obvious and waiting for a human is just adding minutes to your downtime. This is org-wide, configured by an admin at Settings → Incident Policies → Auto-Create.Documentation Index
Fetch the complete documentation index at: https://docs.warrn.io/llms.txt
Use this file to discover all available pages before exploring further.
The master switch
A single toggle at the top: Auto-create incidents. When off, Warrn never opens an incident on its own. When on, the three conditions below decide when it fires. You can turn the master switch on and leave individual conditions off until you trust them.The three conditions
Sustained cluster
Open when an alert recurs at least N times within M min.Catches a flapping or stuck failure. Defaults: 10 recurrences in 5 minutes. Tune higher if your services normally produce bursts; tune lower for quiet services where any sustained pattern is suspicious.
Unacked critical past SLA
Open when a critical alert stays unacknowledged for more than N min.The “nobody’s looking at this” backstop. If a critical alert sits unack’d past the threshold, an incident is opened so it shows up in the incident response queue and someone gets paged on it. Default: 10 minutes.
Cross-service blast radius
Open when a correlated group of alerts spans at least N services within M min.Catches the “everything’s on fire” case: alerts firing across multiple services in a short window are usually one underlying problem, not several. Default: 2 services in 10 minutes.
What gets created
When a condition fires, Warrn:- Opens an incident with severity, title, and description derived from the triggering alerts.
- Links every triggering alert to the incident.
- Stamps an “Auto-created” badge on the incident, with a tooltip explaining which condition fired and why.
- Runs the same notification flow as a human-created incident (Slack channel, on-call paged, etc.).