/kestrel-workflow requests, PagerDuty incidents, PostHog events, Vercel deployment events, custom webhooks, or on-demand runs. Build workflows with the Workflow Agent using natural language, a drag-and-drop canvas, the CLI, SDK, or MCP.
Prerequisites
- A Kestrel account at platform.usekestrel.ai
- At least one integration connected (see Integrations)
Create Your First Workflow
Navigate to Workflows
From the Kestrel dashboard, go to Workflows → New Workflow.You can start from a blank canvas or choose a template. Templates cover common use cases like incident response, cloud provisioning, and CI/CD automation.
Describe your workflow in natural language
Type a plain-English description of what you want automated. The Workflow Agent generates the workflow steps for you.Example:
When a pod crashes in the payments namespace, trigger root cause analysis, send a Slack message with the root cause to #incidents, and create a Jira ticket assigned to the payments team.The Workflow Agent assembles the trigger, actions, and connections. Review the generated workflow on the canvas and adjust as needed.
Configure the trigger
Every workflow starts with a trigger. Select the event source that kicks off the workflow:
Configure trigger-specific filters to control when the workflow fires — for example, limit a K8s trigger to a specific namespace, cluster, or set of AWS accounts.
| Trigger Type | Trigger Blocks |
|---|---|
| Kubernetes Signals | Deployment Replicas Failing, Nodes Unavailable, Pod CrashLoopBackOff, Pod ImagePullBackOff, Pod OOMKilled, Pods Failing, Pods Restarting, StatefulSet Replicas Failing, Node Memory Pressure, Node Disk Pressure, DaemonSet Failing, Any Kubernetes Incident |
| AWS Cloud Signals | IAM Security Event, Root Account Activity, KMS Key Change, Secrets Manager Event, Security Hub Finding, S3 Bucket Change, EC2 Instance Issue, Lambda Function Issue, ECS/EKS Container Issue, RDS Database Issue, DynamoDB Issue, VPC/Network Change, CloudWatch Alarm, Application Log Errors, Config Rule Non-Compliant, AWS Service Health Event, Any AWS Cloud Incident, Cost Anomaly Detected, Budget Threshold Exceeded |
| Slack Requests | Create K8s Resource, Edit K8s Resource, General Kubernetes Request, Create AWS Resource, Edit AWS Resource, General Cloud Request, Any Slack /kestrel-workflow Request |
| PagerDuty | Incident Triggered, Incident Acknowledged, Incident Resolved, Any PagerDuty Incident, High Urgency Incident |
| PostHog | Session Error/Exception, Console Error, Rage Click, Any PostHog Event, Log Error Alert |
| Vercel | Deployment Failed, Deployment Succeeded, Deployment Created, Error Anomaly, Usage Anomaly, Domain Issue, Firewall Attack Detected, Deployment Checks Failed, Production Rollback |
| Jenkins | Build Failed, Build Unstable, Build Succeeded, Build Completed, Build Started |
| CircleCI | Workflow Failed, Workflow Succeeded, Workflow Completed, Job Failed |
| Terraform Cloud | Run Created, Run Planning, Run Needs Attention, Run Applying, Run Completed, Run Errored, Drift Detected, Assessment Check Failed |
| Pulumi Cloud | Update Succeeded, Update Failed, Preview Failed, Destroy Succeeded, Deployment Started, Deployment Succeeded, Deployment Failed, Drift Detected, Drift Run Failed, Policy Violation, Stack Created, Stack Deleted |
| Custom Webhook | Any HTTP POST to your workflow’s unique webhook endpoint with HMAC signature verification |
Configure actions and template variables
Add action steps to your workflow. Each action targets an integration and performs a specific operation — sending a Slack message, creating a Jira ticket, running an RCA, applying a Kubernetes manifest, and so on.Use the variable picker to insert dynamic values from the trigger or from previous action outputs into any field. Variables use the
{{variable_name}} syntax and are type-checked at build time.Actions execute sequentially by default. Use parallel branches on the canvas to run actions concurrently.
Set cooldown and save
Configure a cooldown period to prevent the same trigger from firing the workflow repeatedly in a short window. For example, set a 5-minute cooldown so a pod crash-looping every 30 seconds doesn’t generate dozens of duplicate tickets. You can also select “No cooldown” for workflows that should fire on every event.Click Save to activate the workflow.
Example Workflows
| Use Case | Trigger | Actions |
|---|---|---|
| Self-healing K8s incident | Pod CrashLoopBackOff | RCA → Slack alert → Apply fix → Jira ticket |
| Cloud provisioning via Slack | Slack /kestrel-workflow request | Parse request → Provision AWS resource → Confirm in thread |
| CI/CD automation | GitHub PR merged | ArgoCD sync → Run tests → Notify Slack on failure |
| Cost anomaly response | AWS cost spike detected | Investigate resources → Slack alert to #finops → Linear ticket |
| Vercel deployment failure | Vercel Deployment Failed | Get build logs → AI investigation → Slack notification |
| Jenkins build failure RCA | Jenkins Build Failed | Get console log → AI investigation → Slack alert to #ci → Jira ticket |
| CircleCI flaky-build retry | CircleCI Workflow Failed | Rerun from failed → Wait for pipeline → PagerDuty page if it fails again |
| Terraform apply approval | Terraform Run Needs Attention | Get run plan summary → Slack approval → Apply or Discard run |
| Pulumi update failure retry | Pulumi Update Failed | AI investigation → Slack approval → Run deployment (update) → Wait for result |
| PostHog exception alert | PostHog Session Error | Session summary → Slack alert → Jira ticket if critical |
What’s Next
- Create Custom Integrations — build custom HTTP action blocks and webhook triggers for any API or service
- Workflow Observability — monitor execution history, latency, and failure rates
- Set Up Integrations — connect the tools your workflows need