Advanced Features
    Feature Guide

    Incident Playbooks

    Step-by-step response guides for common monitoring incidents.

    Updated 2026-02-20
    2 min read
    playbook
    incident
    response

    Incident Playbooks#

    Agency Plan Feature#

    Playbooks are step-by-step response guides that walk your team through resolving common incidents consistently.

    What's a Playbook?#

    A structured sequence of steps to follow when a specific type of alert fires. Think of it as a runbook that ensures consistent incident response, even for junior team members.

    Built-in Playbooks#

    LemWatch comes with playbooks for common scenarios:

  1. Site Down — Diagnose connectivity, check DNS, verify server, escalate
  2. SSL Expiring — Verify cert status, contact provider, renew, verify
  3. Performance Degradation — Check Core Web Vitals, identify cause, optimise
  4. Security Issue — Assess severity, patch vulnerability, verify fix

    5. Creating Custom Playbooks#

  5. Go to Playbooks from the sidebar
  6. Click "Create Playbook"
  7. Define trigger conditions (which alert types start the playbook)
  8. Add steps with:
  9. Clear instructions
  10. Checklists for each step
  11. Escalation contacts
  12. Links to relevant tools and documentation
  13. Assign default owners

    14. Running a Playbook#

    When a matching alert fires, the playbook activates. The active team member follows each step, marking them complete. Progress is tracked in real-time, and handoffs between team members preserve the playbook state.

    Playbook Templates#

    Create and share playbook templates across your organisation. Templates can be cloned and customised for specific sites or clients.

    Was this article helpful?

    Previous

    Change Detection & Volatility Alerts

    Next

    Maintenance Windows

    Related Articles

    Setting Up Alerts

    Configure 11 notification channels — email, push, chat, on-call, and automation tools.

    Incident Handoffs

    Hand off active incidents between team members across shifts.

    Pulse review queue, PII, and expected-behavior whitelist

    Pulse scans are public, but visitor email, IP hash, and referrer are never exposed. A review queue catches unexpected findings before they show as failures.

    What is the Answers Hub?

    The Answers Hub is a public Q&A library that mirrors the questions people ask about monitoring, uptime, and site health.

    Back to Help Center