n8n Incident Response & Alert Consolidation Workflow

Stop midnight on-call wake-ups. Auto-merge duplicate alerts. One-click import JSON.

If you've ever been woken at 3 AM by 47 identical pager messages from Prometheus, Zabbix, Datadog and UptimeRobot, this is for you. Instead of a noisy dashboard dumping every alert into your channels, this production-grade, self-hosted n8n workflow turns your monitors into ONE calm, trustworthy incident feed — it collapses duplicates, silences overnight noise, and pages you only when it genuinely needs your attention.

The result: on-call engineers stay focused, alerts are actually answered, and you go back to measuring incidents by MTTR instead of by message count.

WHAT IT DOES

• Multi-source ingestion — 5 ready webhook endpoints (Prometheus Alertmanager, Zabbix, Datadog, UptimeRobot, custom) plus any custom payload.

• Automatic payload normalization — every vendor JSON is mapped to one standard alert shape, so one rule set governs all sources; resolved alerts are filtered automatically.

• Smart deduplication & clustering — a unique fingerprint (host + rule) recognises the same incident; dozens of repeats collapse into one with an incremental count, so the first one is all you see.

• Grade-based routing — P1 → Slack + PagerDuty paging; P2 → Slack/Teams message; P3 → log only. No more one-size-fits-all noise.

• Configurable silent window — set 22:00–07:00 and only real P1s can page; blacklist keywords, temporary mute and fingerprint whitelist give you fine-grained control.

• Never false-alarms — unclassified or missing severities auto-degrade to a safe log-only path: no paging, no channel flood, still captured for review.

• MTTR & noise analytics — every decision is written to a PostgreSQL event log (active / duplicate / suppressed) so you can compute mean-time-to-resolve and hunt down chronic noise with real data.

WHY BUYERS CHOOSE THIS

• Pure native nodes — runs on your self-hosted n8n v1.20–1.60; no third-party or paid nodes, no dark magic.

• 100% configurable — every business rule lives in clear CONFIG blocks; zero code editing, live in ≤10 minutes.

• No lock-in, no telemetry — everything runs inside your own n8n + Postgres; GDPR friendly.

• Purpose-built for operations — dedup, silent window, blacklist, temp mute, whitelist and MTTR logging work together out of the box.

SAVE 3–8 DAYS of self-building and debugging webhook normalisation, clustering, silent windows and dedup logging. Ship a calmer on-call rotation this week.