# Diagnose incident root causes and plan remediation with Claude: n8n workflow

> Started by another system calling it, and works across WhatsApp. 30 steps, 2 branches, 2 loops or waits: large, and worth reading before you trust it with...

Source: https://millionrounds.com/workflow/diagnose-incident-root-causes-and-plan-remediation-with-clau (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# Diagnose incident root causes and plan remediation with Claude

Started by another system calling it, and works across WhatsApp. 30 steps, 2 branches, 2 loops or waits: large, and worth reading before you trust it with anything live.

Large

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fdiagnose-incident-root-causes-and-plan-remediation-with-clau)

**30 steps** Large: read it before trusting it with anything live

**2** Branches: places the flow splits

**2** Loops or waits

**1** Service it connects to

## The flow

Starts it 2 Logic 13 Service 15

The steps in the order they run, from what starts it.

- 1 **Webhook - Incident Triggered** Webhook *Starts it*
- 2 **Manual Trigger - Test Run** Manual trigger *Starts it*
- 3 **Set - Config** Set *Logic*
- 4 **HTTP Request - Fetch Application Logs** Http Request *Service*
- 5 **HTTP Request - Fetch Metrics Snapshot** Http Request *Service*
- 6 **HTTP Request - Fetch Distributed Traces** Http Request *Service*
- 7 **HTTP Request - Fetch Recent Commits** Http Request *Service*
- 8 **HTTP Request - Fetch Recent Pull Requests** Http Request *Service*
- 9 **HTTP Request - Fetch Infrastructure Change Log** Http Request *Service*
- 10 **HTTP Request - Fetch Recent Deployments** Http Request *Service*
- 11 **Merge - Combine All Evidence Sources** Merge *Logic*
- 12 **JS - Build Unified Timeline & Correlate Events** Code *Logic*
- 13 **HTTP Request - Claude: Identify Probable Root Cause** Http Request *Service*
- 14 **JS - Parse Root Cause Analysis** Code *Logic*
- 15 **HTTP Request - Claude: Rank Evidence & Build Remediation Plan** Http Request *Service*
- 16 **JS - Parse Remediation Plan** Code *Logic*
- 17 **WhatsApp - Send Root Cause Report** Whats App *Service*
- 18 **Wait - For Human Decision** Wait *Logic*
- 19 **IF - Execute Remediation Plan** If *Logic*
- 20 **HTTP Request - Trigger Remediation Action** Http Request *Service*
- 21 **Set - Case Status Dismissed** Set *Logic*
- 22 **WhatsApp - Send Remediation Started** Whats App *Service*
- 23 **Wait - For Remediation Verification Grace Period** Wait *Logic*
- 24 **HTTP Request - Re-Fetch Metrics Snapshot** Http Request *Service*
- 25 **JS - Evaluate Post-Remediation Health** Code *Logic*
- 26 **IF - Incident Resolved** If *Logic*
- 27 **Set - Case Status Resolved** Set *Logic*
- 28 **Set - Case Status Escalated** Set *Logic*
- 29 **WhatsApp - Send Resolution Confirmed** Whats App *Service*
- 30 **WhatsApp - Send Escalation (Remediation Ineffective)** Whats App *Service*

## How it's built

- **Starts on:** Another system calling it
- **Steps:** 30, with 2 branches, 2 loops or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** WhatsApp
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own WhatsApp account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on another system calling it.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Take your time. At 30 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 30 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fdiagnose-incident-root-causes-and-plan-remediation-with-clau)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[WhatsApp](https://millionrounds.com/workflows?service=WhatsApp#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Predict and prevent service failures with Claude and ClickUp** 30 steps · WhatsApp](https://millionrounds.com/workflow/predict-and-prevent-service-failures-with-claude-and-clickup)
- [**Email cleaner with Gmail and WhatsApp** 28 steps · Gmail, WhatsApp](https://millionrounds.com/workflow/email-cleaner-with-gmail-and-whatsapp)
- [**Triage AWS security posture changes with Claude and Slack** 28 steps · calls a model · Email, Slack](https://millionrounds.com/workflow/triage-aws-security-posture-changes-with-claude-and-slack)
- [**Monitor exposed secrets in GitHub and CI logs with WhatsApp** 27 steps · WhatsApp](https://millionrounds.com/workflow/monitor-exposed-secrets-in-github-and-ci-logs-with-whatsapp)
- [**Monitor engineering health across ClickUp, GitHub and APM** 25 steps · WhatsApp](https://millionrounds.com/workflow/monitor-engineering-health-across-clickup-github-and-apm)
- [**Monitor engineering health with ClickUp and GitHub** 25 steps · WhatsApp](https://millionrounds.com/workflow/monitor-engineering-health-with-clickup-and-github)