Autonomous Agent - Incident Intake and Analysis

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "name": "Autonomous Agent - Incident Intake and Analysis",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "autonomous-agent/incidents",
        "responseMode": "responseNode",
        "options": {}
      },
      "id": "30d84078-021e-403b-9e8b-3a93762edb8d",
      "name": "Incident Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        120,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const body = $json.body ?? $json;\nconst required = ['incident_id', 'title', 'description'];\nconst missing = required.filter((key) => !body[key]);\nif (missing.length) throw new Error(`Missing required fields: ${missing.join(', ')}`);\nconst incident = {\n  incident_id: String(body.incident_id),\n  title: String(body.title),\n  description: String(body.description),\n  severity: String(body.severity ?? 'unknown'),\n  service: String(body.service ?? 'unknown'),\n  environment: String(body.environment ?? 'production'),\n  started_at: body.started_at ?? new Date().toISOString(),\n  symptoms: Array.isArray(body.symptoms) ? body.symptoms : [],\n  recent_changes: Array.isArray(body.recent_changes) ? body.recent_changes : [],\n  metrics: body.metrics ?? {},\n  logs: body.logs ?? [],\n  runbook_links: body.runbook_links ?? [],\n  requested_by: String(body.requested_by ?? 'n8n-webhook')\n};\nreturn [{json:{incident, correlation_id:`incident:${incident.incident_id}`}}];"
      },
      "id": "6276c2cd-cf55-47df-af7f-9d6f26b2bab7",
      "name": "Validate and Normalize Incident",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        350,
        300
      ]
    },
    {
      "parameters": {
        "operation": "create",
        "task": "=Investigate production incident {{$json.incident.incident_id}} ({{$json.incident.title}}). Perform structured triage and root-cause analysis. Rank hypotheses by likelihood and evidence. Produce immediate containment actions, a safe remediation plan, validation checks, rollback steps, and an executive summary. Do not execute production changes. Request approval before any capability classified as production-change.",
        "mode": "supervised",
        "contextInputMode": "json",
        "contextJson": "={{ { incident: $json.incident, orchestration: { source: 'n8n', correlation_id: $json.correlation_id, workflow: 'incident-response' } } }}",
        "includeDesiredOutput": true,
        "desiredOutputFormat": "json",
        "desiredOutputSchema": "{\n  \"type\": \"object\",\n  \"required\": [\n    \"incident_summary\",\n    \"severity_assessment\",\n    \"probable_causes\",\n    \"containment\",\n    \"remediation\",\n    \"validation\",\n    \"rollback\",\n    \"approval_required\"\n  ],\n  \"properties\": {\n    \"incident_summary\": {\n      \"type\": \"string\"\n    },\n    \"severity_assessment\": {\n      \"type\": \"string\"\n    },\n    \"probable_causes\": {\n      \"type\": \"array\"\n    },\n    \"containment\": {\n      \"type\": \"array\"\n    },\n    \"remediation\": {\n      \"type\": \"array\"\n    },\n    \"validation\": {\n      \"type\": \"array\"\n    },\n    \"rollback\": {\n      \"type\": \"array\"\n    },\n    \"approval_required\": {\n      \"type\": \"boolean\"\n    }\n  }\n}",
        "desiredOutputMediaType": "application/json",
        "includeConstraints": true,
        "deadlineSeconds": 900,
        "maximumAgentCalls": 15,
        "maximumToolCalls": 20,
        "allowedCapabilities": "incident-root-cause-analysis,production-remediation-plan",
        "deniedCapabilities": "",
        "allowedTools": "",
        "deniedTools": "",
        "requireApprovalFor": "production-remediation-plan",
        "metadataInputMode": "json",
        "metadataJson": "={{ { incident_id: $json.incident.incident_id, service: $json.incident.service, severity: $json.incident.severity, correlation_id: $json.correlation_id } }}",
        "idempotencyKeyMode": "manual",
        "idempotencyKey": "={{$json.correlation_id}}",
        "waitUntilComplete": true,
        "pollingInterval": 5,
        "maximumWaitTime": 840,
        "terminalStatuses": "completed,failed,cancelled,rejected",
        "stopWhenApprovalRequired": true,
        "returnInitialResponseOnTimeout": true,
        "retryTemporaryErrors": true
      },
      "id": "80cbee96-63af-42c2-aa37-17dc49ae7af1",
      "name": "Create and Poll Incident Analysis",
      "type": "n8n-nodes-autonomous-agent.autonomousAgentExecution",
      "typeVersion": 1,
      "position": [
        610,
        300
      ],
      "credentials": {
        "autonomousAgentApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "operation": "list",
        "executionId": "={{$('Create and Poll Incident Analysis').item.json.execution_id}}",
        "splitIntoItems": false
      },
      "id": "6b14d3df-a56e-4b6c-ae47-247ed03d8ec6",
      "name": "List Pending Approvals",
      "type": "n8n-nodes-autonomous-agent.autonomousAgentApproval",
      "typeVersion": 1,
      "position": [
        860,
        220
      ],
      "credentials": {
        "autonomousAgentApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "operation": "list",
        "executionId": "={{$('Create and Poll Incident Analysis').item.json.execution_id}}",
        "splitIntoItems": false
      },
      "id": "46b74ee1-9592-4398-bbae-25b5bfbbb4ff",
      "name": "List Audit Events",
      "type": "n8n-nodes-autonomous-agent.autonomousAgentEvent",
      "typeVersion": 1,
      "position": [
        860,
        380
      ],
      "credentials": {
        "autonomousAgentApi": {
          "name": "<your credential>"
        }
      }
    },
    {
      "parameters": {
        "mode": "combine",
        "combineBy": "position",
        "options": {}
      },
      "id": "a41efffc-2eec-433f-9d32-2a35cb267a36",
      "name": "Merge Audit Data",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3,
      "position": [
        1100,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const execution = $('Create and Poll Incident Analysis').item.json;\nconst approvalsNode = $('List Pending Approvals').item.json;\nconst eventsNode = $('List Audit Events').item.json;\nconst approvals = approvalsNode.approvals ?? approvalsNode.items ?? approvalsNode.data ?? approvalsNode;\nconst events = eventsNode.events ?? eventsNode.items ?? eventsNode.data ?? eventsNode;\nreturn [{json:{\n  accepted: true,\n  incident_id: $('Validate and Normalize Incident').item.json.incident.incident_id,\n  execution_id: execution.execution_id,\n  status: execution.status,\n  current_step: execution.current_step ?? null,\n  output: execution.output ?? execution.result ?? null,\n  approval_required: ['awaiting_approval','approval_required','waiting_for_approval'].includes(String(execution.status)),\n  approvals,\n  event_count: Array.isArray(events) ? events.length : undefined,\n  links: {\n    approval_webhook: '/webhook/autonomous-agent/incidents/approval',\n    artifact_webhook: `/webhook/autonomous-agent/executions/${execution.execution_id}/artifacts`\n  }\n}}];"
      },
      "id": "b6a48de3-7918-4eb7-98ce-8d404fb7686b",
      "name": "Build Incident Response",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        1330,
        300
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{$json}}",
        "options": {
          "responseCode": 202
        }
      },
      "id": "57266413-d9fa-4950-9511-966c1eb0b1b8",
      "name": "Respond to Incident Request",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1.4,
      "position": [
        1560,
        300
      ]
    }
  ],
  "connections": {
    "Incident Webhook": {
      "main": [
        [
          {
            "node": "Validate and Normalize Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate and Normalize Incident": {
      "main": [
        [
          {
            "node": "Create and Poll Incident Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Create and Poll Incident Analysis": {
      "main": [
        [
          {
            "node": "List Pending Approvals",
            "type": "main",
            "index": 0
          },
          {
            "node": "List Audit Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "List Pending Approvals": {
      "main": [
        [
          {
            "node": "Merge Audit Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "List Audit Events": {
      "main": [
        [
          {
            "node": "Merge Audit Data",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Audit Data": {
      "main": [
        [
          {
            "node": "Build Incident Response",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Incident Response": {
      "main": [
        [
          {
            "node": "Respond to Incident Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "active": false,
  "settings": {
    "executionOrder": "v1",
    "saveManualExecutions": true,
    "saveExecutionProgress": true
  },
  "versionId": "146b6a25-7c09-4fb3-9dae-19d85b7958fd",
  "meta": {
    "templateCredsSetupCompleted": false
  },
  "tags": []
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• autonomousAgentApi

About this workflow

Autonomous Agent - Incident Intake and Analysis. Uses n8n-nodes-autonomous-agent. Webhook trigger; 8 nodes.

Source: https://github.com/MustiSquare/n8n-with-autonomous-agent-nodes/blob/main/n8n/local-data/workflows/02-incident-intake-and-analysis.json — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.