All Quiet Masterclass: Automatically Linking Runbooks to Incidents

TL;DR – Instantly Attach the Right Runbook to Every Incident

🔹 Problem: Searching for the right runbook during an incident wastes time.

🔹 Solution: Use All Quiet’s payload mapping engine to automatically link incidents to the correct runbook based on payload items.

🔹 How? In the Payload Mapping section of your inbound integration, add a "Runbook" attribute with a mapping like this:

  
    {
      "map": "500 Error->https://your-wiki.com/runbook-1,Database Connection Issue->https://your-wiki.com/runbook-2,CPU Usage High->https://your-wiki.com/runbook-3,->https://your-wiki.com/general-troubleshooting"
    }
  

✔ This works for any payload item — alert title, description, type, or any other field in the payload.
✔ Exact matches link to specific runbooks.
✔ A default fallback to an general troubleshooting page ensures every incident has a runbook.

🎯 Result: No more searching for documentation — your team gets the right runbook, instantly.

Now, let’s break it down step by step.

---

The Problem – Searching for Runbooks During an Incident Wastes Time

If you’ve ever been in the middle of an incident, you know how frustrating it is to scramble for the right documentation. Every second counts, but instead of focusing on resolving the issue, you’re digging through Confluence, Notion, or internal wikis, trying to find the right runbook.

What if incidents could automatically link to the right runbook, based on the payloads title, description, or any other attribute? No more searching. No more guesswork. Just instant access to the exact documentation you need.

In this article, we’ll show you how to map any incident to the correct runbook automatically using All Quiet’s payload mapping engine.

The Solution – Map Payload Elements to Incident Runbooks

The best way to understand how this works is through a real-world example. Let’s walk through the setup step by step. And if you have any questions? As always - just shoot me a message.

Step 1 – Choose a Payload Element for Mapping

Before configuring anything, we need to decide which payload element should determine the runbook link.

• Select a payload element whose values will clearly indicate which runbook should be linked.
• Remember, each integration might have slightly different names for the payload elements.

For this example, we’ll map the "alert_title" field from our Datadog integration's payload. You can apply the same method to any other field or integration.

Step 2 – Define Your Incident Title to Runbook Mapping

Let’s say we have the following "alert_title" specifications:

alert_title	Runbook URL
500 Error	https://your-wiki.com/runbook-1
Database Connection Issue	https://your-wiki.com/runbook-2
CPU Usage High	https://your-wiki.com/runbook-3
(Anything Else)	https://your-wiki.com/general-troubleshooting

Now, let’s configure this mapping in All Quiet.

Step 3 – Add the Mapping in the Payload Section

To set up the mapping, follow these steps:

1. Navigate to the Inbound Integrations in your All Quiet web app.

2. Select the Integration that you want to add runbooks to.

3. Open the Payload Mapping tab.

4. In the Mapping section, add a new attribute.

Define the mapping attribute as follows:

1. Name: Select a name for the incident attribute. Obviously, something like "Runbook" makes sense, here.

2. Payload Item: Define they payload item that you are looking for. Here it's the "alert_title" that is part of the payloads jsonBody.

3. Mapping: Define which "alert_title" should link to which runbook, using the following mapping for our example.

  
    {
      "map": "500 Error->https://your-wiki.com/runbook-1,Database Connection Issue->https://your-wiki.com/runbook-2,CPU Usage High->https://your-wiki.com/runbook-3,->https://your-wiki.com/general-troubleshooting"
    }
  

✔ This works for any payload item — alert_title, description, name...
✔ Exact matches link to specific runbooks.
✔ The default fallback (->) ensures all other incidents get a general troubleshooting guide.

Step 4 – How the Mapping Works in an Incident

Let's see it in action. The image below shows: A “500 Error” alert comes in → It’s automatically linked to https://allquiet.app/runbook-1

With this setup, responders no longer need to waste time searching for documentation — it’s right there in the incident.

Final Thoughts

By automatically linking incidents to runbooks, you reduce friction, save time, and make incident response smoother.

🚀 No more searching for docs.
🚀 No more manual linking.
🚀 Just instant access to the right runbook when you need it.

Take a look at your current setup — could you benefit from automated runbook mapping? If so, try implementing this today!

Have questions? Need help configuring your mappings? Let’s chat!

☎️ Schedule a quick call

- Peer
CEO & Co-Founder of All Quiet