GUIDES · RESPOND
Spinning a war room from a single case.
When a case crosses the SEV-1 line you want a room — roster, timeline, comms bridge — already wired, not assembled by hand while the incident runs. A war room spins up from a case in seconds.
Trigger a war room
Open a room from any case, by hand for a judgment call or automatically from a playbook when severity crosses a threshold.
SHELLfrom the CLI $ td warroom open --case case_7Qd2 --sev 1 -> roster paged: soc-oncall, ir-lead, comms -> timeline seeded from case (11 events) -> bridge: https://td.acme.io/war/wr_3kP ok war room wr_3kP live
Or wire it into a playbook so the room exists before the third Slack message:
YAMLplaybook step - id: escalate action: warroom.open when: case.severity == "CRITICAL" roster: [soc-oncall, ir-lead, comms]
What spins up
The room is not an empty channel. It opens pre-populated from the case so responders start oriented.
- Roster — the right people paged by role, with on-call resolved automatically.
- Timeline — every event, detection, and action from the case, updating live.
- Tasks — an assignable checklist; owners and status visible to all.
- Comms bridge — a linked Slack/Teams channel and a status-page draft.
Close it out
Resolving the room writes the final timeline back to the case and exports a clean record — the starting point for the retro, with no reconstruction needed.
The timeline is the artifact. Everything said and done in the room is timestamped against the case, so the post-incident review and any regulatory narrative come straight from the record — see running an incident retro.
Where to go next
- War room — the product surface in depth.
- Running an incident retro — turn the timeline into learnings.