PagerDuty Alert Enrichment with Baseline + Runbook Context

This workflow fires on every new PagerDuty incident and does the legwork an engineer would do in the first five panicked minutes: it identifies the alerting metric, pulls its historical baseline from Datadog to show how far outside normal the current value is, locates the matching runbook in Confluence, and posts a single enriched context card to the incident's Slack channel. The responder opens the page already knowing the severity and the first remediation step.

Use it to cut mean-time-to-context on noisy or unfamiliar alerts, especially for rotations where responders cover services they didn't build.

1. 1A PagerDuty incident trigger delivers the alert payload and offending metric.
2. 2Datadog is queried for that metric's current value and 28-day baseline at the same hour-of-week.
3. 3A logic step computes the deviation and a rough severity score from the baseline gap.
4. 4Confluence is searched for the runbook tied to the alert's monitor or service tag.
5. 5OpenAI drafts a concise context card: what's abnormal, by how much, and the first runbook action.
6. 6The card is posted to the incident's Slack channel and linked back onto the PagerDuty incident.