Slack commands to work with Incident Response

Incident Response slash commands begin with /lightstep and trigger an HTTP request to a web service that can, in turn, post one or more messages in response. Every slash command works on both the mobile and desktop versions of the Slack app. The Slack commands are available to all users with responder, manager, or administrator roles.

Table 1. Built-in Incident Response Slash commands
Slash command Action
/lightstep help Provides a list of available slack commands with its description. If you enter an invalid command, /lightstep help is executed by default.
/lightstep invite [Email ID] [Role] Invites a user to join your team.
/lightstep invite stakeholder

The available roles are Administrator, Manager, Responder, and Stakeholder. If you do not add any role, the user gets added as a responder.

/lightstep opentasks Provides a list of your current unacknowledged alerts.
Note: Once you acknowledge an alert, it is automatically assigned to you.
/lightstep assignedtasks Provides a list of open tasks that are assigned to you.
/lightstep teamtasks Provides a list of unacknowledged tasks for your team.
/lightstep close [Alert/Incident Number] [Close Notes] Closes a specific alert or incident.

To close an alert or an incident use /lightstep close <alert or incident number> <"Reason to close">. Place the reason to close within quotation marks. For example: /lightstep close Alert00234 "Reason to close".

Note: If you are in a channel that is opened from a specific alert or incident, then you need not mention the alert or the incident number. For example, /lightstep close "Reason to close note".
/lightstep collaborate [Zoom] Collaborate using Zoom.
/lightstep collaborate [Zoom] [Alert/Incident Number] Start the conference via Zoom with the given alert or incident number.
/lightstep searchteams [Team name (partial) description] Searches for a team using a single word or any of the following in parenthesis:

"part of a team name" | "manager name" | "user name"

/lightstep checkoncall [Complete Team name or description] Searches for a team's on-call members.

Add the "team name" to the command. The command returns the current on-call members of the team, a list of teams to choose from, or shows no result.

/lightstep oncallstatus Provides your current on call status.
/lightstep taskdetails [Alert/Incident Number] Provides the details of a specific alert or incident. It also provides command actions to reassign team or user or add work notes.

Command actions.

Note: When the command actions such as Reassign Team, Reassign User, or Add Worknotes are executed from a private channel, you do not receive a confirmation even if the action is executed successfully.
If you want to receive those confirmation messages, you must add the Lightstep Incident Response integration to your channel using the following steps:
  1. Click the View all members icon (View all members icon.).
  2. Click the Integrations tab.
  3. Under Apps, click Add an App.
  4. From the list, select the Lightstep Incident Response app and click Add.
    Note: The integration is added to your private channel and you start receiving confirmations on the command actions.
Note: Only users who are signed up with Incident Response can use the slash commands.