Escalation matrix | alerting more people

Goal: Set up an escalation matrix that, after a certain time of an unresolved incident (outage), sends an alert to additional responsible people or to another channel.

When to use escalation

A common scenario: your service goes down at night, the primary on-call person does not respond within 15 minutes - the system should automatically notify the shift lead and, after another hour, the manager too. Escalation prevents an outage from going unnoticed.

Step 1: Create an escalation policy

Go to Dashboard → Escalation (or to /dashboard/escalation).
Enter a name (for example "Night on-call") and click + New policy.

List of escalation policies — Overview of escalation policies in the dashboard.

Step 2: Add steps

A policy is a sequence of steps. Each step contains:

Escalation policy editor with steps, delay and recipients — Policy editor: you add steps with a delay in minutes, a channel and recipients.

Delay (min) - how many minutes after the start of the incident the step should trigger. 0 means immediately.
Channel - E-mail or Webhook (Slack, Discord, your own target endpoint).
Recipients - comma-separated e-mail addresses, or a webhook address.
Note - optional, what the recipient should do.

Example of a 3-tier policy:

Step 1: 0 min, e-mail to the primary on-call person.
Step 2: 15 min, e-mail to the shift lead.
Step 3: 60 min, Slack webhook to the #ops-emergency channel.

Step 3: Assign the policy to monitors

You can assign a policy:

Globally - the "Set as default" button applies it to all your monitors that do not have their own.
For a specific monitor - when creating or editing a monitor, select a specific policy.

Incident acknowledgement (ACK)

Every escalation alert contains an ACK link (acknowledge, meaning "I have seen it and I am handling it"). Just click it and:

The remaining escalation steps stop.
The system records who acknowledged the incident and when.
Others in the same step no longer receive further escalation messages for this incident.

The ACK link does not require a login - it is signed with a unique token (a one-time string), so no one else can misuse it. Once the incident is resolved (the monitor returns to the UP state), the escalation also ends automatically.

Webhook format

For Slack, Discord, Microsoft Teams and your own endpoint we send the request using the POST method. For Slack, Discord and Teams we format the payload natively (Block Kit / Embed / Adaptive Card). For other addresses (your own endpoint) we send a generic JSON:

{
  "event": "incident_escalation",
  "monitor": {
    "name": "Production website",
    "target": "https://example.com",
    "url": "https://epulz.io/dashboard/monitor/42"
  },
  "message": "ESCALATION step 2 (delay 15 min): e-mail to the shift lead",
  "timestamp": "2026-05-31T14:33:45+00:00",
  "source": "epulzio"
}

The event field has the value incident_escalation for escalation. The message field contains a text description of the step (step order, delay and a description of the action). Other fields (incident_id, step_order, ack_url) do not exist at the top level - the ACK link is part of the formatted message in Slack/Discord/Teams. For Slack, the Incoming webhook address is enough. For a Discord address, the ?wait=true parameter is not needed.

Frequently asked questions

What happens if the incident lasts longer than the last step?

No further escalations are sent. For repeated reminders, add another step with a higher delay (for example 240 min).

Does escalation work during quiet hours?

Yes. Escalation goes through its own channel (e-mail, webhook) and quiet hours do not apply to it - those are only for primary alerts.

Can I test the policy without waiting for a real outage?

The easiest way: create a test monitor with the address https://test-bad-domain.invalid, assign it a policy with a short delay (1 min) and watch the e-mails.

Escalation matrix - alerting more people