DEV Community

Cover image for Incident Response Management with Google Workspace & PagerDuty Integration
The Unmeshed Team
The Unmeshed Team

Posted on • Originally published at unmeshed.io

Incident Response Management with Google Workspace & PagerDuty Integration

#devops #sre #automation #productivity

Incident response works better when the steps are clear

When an incident starts, the team usually needs the same few things every time: a place to record what happened, a doc for notes, a page to the on-call person, and a way to keep everyone else informed. This workflow keeps those pieces in one place.

A visual workflow diagram showing an automated incident response process. The flow starts with a Start node and moves through HTTP Get, Google Sheets (create a new sheet), Google Sheets (add the incident response), Google Docs (create an incident document), PagerDuty (page the on-call team), and Gmail (notify stakeholders), before ending at an End node. The workflow illustrates how incident details move through multiple integrations in a clear, sequential process.

What the workflow does

The workflow is simple:

incident event
  -> get_current_oncall
  -> create_new_sheet
  -> add_incident_response
  -> create_incident_document
  -> page_oncall
  -> notify_stakeholders
Enter fullscreen mode Exit fullscreen mode

Each step does one thing:

  1. get_current_oncall looks up the current on-call owner.
  2. create_new_sheet creates a shared incident tracker in Google Sheets.
  3. add_incident_response writes the incident details into the sheet.
  4. create_incident_document generates a Google Doc for notes and updates.
  5. page_oncall triggers PagerDuty when escalation is needed.
  6. notify_stakeholders sends a stakeholder email with links to the sheet and doc.

Workflow definition

This is the workflow shape used in the post:

orgId: 1
namespace: incident-management
name: incident_response_automation
version: 1
type: API_ORCHESTRATION

steps:
  - name: get_current_oncall
    type: HTTP
    input:
      method: GET
      url: https://devs.unmeshed.com/api/call/get_current_oncall/get_current_oncall/fixed?apiCallType=SYNC

  - name: create_new_sheet
    type: INTEGRATION
    input:
      type: google-sheets
      publishProperties:
        action: CREATE_SPREADSHEET
        title: New Incident Created

  - name: add_incident_response
    type: INTEGRATION
    input:
      type: google-sheets
      publishProperties:
        action: APPEND_ROWS
        spreadsheetId: "{{ steps.create_new_sheet.output.spreadsheetId }}"
        range: Sheet1!A1
        values:
          - [
              IncidentId,
              Severity,
              Service,
              Message,
              Status,
              AssignedTo,
              CreatedAt,
            ]
          - [
              "{{ context.incidentId }}",
              "{{ context.input.severity }}",
              "{{ context.input.service }}",
              "{{ context.input.message }}",
              OPEN,
              "{{ steps.get_current_oncall.output.response.output.oncall }}",
              "{{ context.created }}",
            ]

  - name: create_incident_document
    type: INTEGRATION
    input:
      type: google-docs
      publishProperties:
        action: CREATE_DOC
        title: New Incident Document

  - name: page_oncall
    type: INTEGRATION
    optional: true
    input:
      type: pagerduty
      messageBody:
        event_action: trigger
        dedup_key: "{{ context.input.message }}"
        summary: "{{ context.input.message }}"
        severity: "{{ context.input.severity }}"
        source: "{{ context.input.service }}"
        links:
          - href: https://docs.google.com/spreadsheets/d/{{ steps.create_new_sheet.output.spreadsheetId }}
            text: View Incident Report
          - href: https://docs.google.com/documents/d/{{ steps.create_incident_document.output.docId }}
            text: View Incident Document

  - name: notify_stakeholders
    type: INTEGRATION
    input:
      type: google-gmail-read-send
      publishProperties:
        action: sendEmail
        subject: A New Incident Reported
        to: "{{ variables.stakeholdersSharedEmail }}"
        bodyContentType: html
Enter fullscreen mode Exit fullscreen mode

Workflow output

These screenshots show the result of each integration after the workflow completed.

Sheets data

A Google Sheets spreadsheet titled “New Incident Created” showing an automated incident record. The sheet contains columns for IncidentId, Severity, Service, Message, Status, and AssignedTo, with a sample incident marked Critical for the payment service. The message states “API error rate exceeded threshold”, the status is OPEN, and the incident is assigned to an email address.
This is the row that got written into Google Sheets. It keeps the incident id, severity, service, message, status, assignee.

Docs data

A Google Docs document titled “New Incident Document” showing an automatically generated incident report. The document includes sections for Incident Overview, Basic Information, Incident Description, and Affected Systems / Services. It records incident ID INC-123-TEST, severity Critical, status OPEN, the assigned owner, and the issue “API error rate exceeded threshold” affecting the payment service.

This is the Google Doc the workflow created for the incident. It gives the team a place for the summary, affected service, assigned owner, and follow-up notes.

Gmail message

A Gmail incident notification email titled “A New Incident Reported” with a prominent red “New Production Incident Reported” header. The email displays the incident severity as HIGH and includes details such as the incident ID, reported time, affected payment service, error message, and assigned owner. It also states that the incident details and updates were added to the incident tracking sheet and includes a “View Incident Report” button.

This is the email that was sent to stakeholders. It includes the incident details plus links to the sheet and the doc so people can open the right record immediately.

Integration setup

These are the two setup screens that matter most.

Google integrations

An integration setup screen with “google” entered in the Quick Search field. The results show Google services available to add, including Google BigQuery under Database, and Google Docs, Google Drive, and Google Sheets under File Storage. Each integration card lists its capabilities and includes an “Add” button for connecting the service.

This connects the sheet and doc steps so the incident record and notes go straight into Google Workspace.

PagerDuty integration

An integration setup screen with “Pagerd” entered in the Quick Search field. The results display the PagerDuty integration under Monitoring, with capabilities including creating and managing incidents, sending alerts and notifications, tracking incident resolution, integrating with monitoring tools, and managing on-call schedules. An “Add” button is shown at the bottom of the PagerDuty integration card.

This is the page to the on-call person when the incident needs escalation.

How the flow works

1. Capture the incident

An alert, webhook, or manual trigger starts the workflow with a small payload such as incidentId, service, severity, and message.

2. Find the on-call owner

The workflow checks who is on call and stores it right away so the assignment is visible to everyone working the incident.

3. Create the record

Google Sheets becomes the incident tracker. The workflow creates the sheet, then writes the first row so the team has a shared record right away.

4. Generate the incident document

Google Docs gives the team a place for the timeline, notes, and follow-up. That keeps the details out of chat threads.

5. Page and notify

PagerDuty handles the escalation. Gmail sends the update with the links everyone needs.

Why this version is better

  1. You create the sheet first, before anything else needs it. The page to on call links straight back to both the sheet and the doc, using the IDs Google returns when each one gets created.

  2. The sheet and the doc give your team one place to check what happened. Nobody has to dig through old messages to find the incident owner.

  3. The page to on-call and the stakeholder email pull from the same incident record. Both use the same ID, severity, service, and message. You enter these details once, and every downstream step uses that same data.

  4. Each integration does one job. The sheet step writes rows. The doc step creates a doc. Nothing tries to do two things at once, so the workflow stays easy to follow.

Practical notes

  1. Keep the header row fixed at Sheet1!A1. Every row you add after that lands in the wrong column if the header shifts.

  2. Use a doc template with placeholders for the summary, owner, and timestamps. Fill them in as the incident happens.

  3. Add the PagerDuty step only when the incident needs escalation. It's marked optional in the workflow for that reason.

  4. Include the sheet and doc links in the stakeholder email. Your team can check the record themselves instead of asking for updates.

Closing

Incident response doesn't need to be a pile of scripts and handoffs. A small workflow handles all of it. It catches the incident and assigns the owner, then creates the record and notifies the right people. No extra coordination needed.

Top comments (0)