Managed Responses: what they are
Rules that say what should happen when an incident opens, and then make it happen.
A Managed Response is a rule: when something happens to a monitor, do something. You write it once and apply it broadly, to every monitor, a team, a group, a kind of monitor, or a single monitor.
The parts of a response
- Which monitors: where the rule applies.
- When it runs: the kind of incident (down, slow, certificate or domain expiring) and the condition, such as "as soon as it opens" or "still open after 30 minutes".
- What it does: one or more actions, in order.
- How carefully: run automatically, ask a person to approve, or practice only.
What a response can do
- Notify the team that owns the monitor, or specific teams or contacts.
- Call a webhook with a message to your own system.
- Add an address to a Cloudflare list or an AWS WAF IP set, for a set time.
Start from a playbook
When you create a response, choose a starting point: escalate after 30 minutes, flapping monitors, a recovery notice to chat, an SSL and domain expiry heads-up, a slow-response digest, or a webhook. Change anything you like.