Monitoring Workflows & Automation

The workflow builder is a full React application embedded in your dashboard. Drag nodes from the sidebar, drop them on the canvas, and connect them with edges. Each node has a configuration panel where you set thresholds, choose notification channels, or write condition logic.

The canvas shows you the entire execution path. Follow the flow from trigger to notification to incident creation. When a workflow runs, each node lights up with its result - passed, failed, or skipped.

Every workflow is assembled from the same four kinds of node:

• 49 Triggers: instance status, TCP ports, and metric thresholds; systemd units; Docker container state and restart loops; PostgreSQL, MySQL, and Galera clusters; RabbitMQ backlogs; HAProxy backends; PHP-FPM saturation; RAID, SMART, ZFS, and Ceph; Proxmox clusters, nodes, guests, and storage; QEMU guests; SNMP devices and interfaces; uptime, response time, SLA breaches, and SSL expiry; missed cron jobs and heartbeats; CVEs and fail2ban bans; temperature sensors and NVIDIA GPUs; vLLM inference servers; WireGuard peers; MQTT topics; Prometheus and VictoriaMetrics health; incident lifecycle; agent version and quota.
• 10 Logic nodes: Condition (if/else branching), Delay, Recheck Trigger, Repeat While, and the six escalation gates below.
• 8 Notification channels: Email, Slack, Microsoft Teams, Telegram, Discord, Pushover, PagerDuty, and Webhooks.
• 2 Actions: Create Incident and Close Incident.

Each node type can be used as many times as you need. Branch the graph to route different failures to different teams, and use as many workflows as you want - there is no per-workflow charge on any plan.

Most monitoring tools give you a threshold and a webhook, then sell on-call routing as a second product. In Fivenines the escalation logic is six nodes you drop on the same canvas:

• Schedule Gate: branch on time of day and day of week. Page during business hours, queue an email overnight - or the reverse for a night-shift rota.
• Maintenance Gate: branch on whether the host is in a maintenance window, so planned work does not wake anyone.
• Cooldown: suppress repeat pass-throughs inside a time window. One page per incident, not one per evaluation cycle.
• Dependency Gate: suppress a service alert when the host itself is down. You get one 'server is down', not forty 'the database, the queue, and the proxy are unreachable'.
• Severity Router: branch on the alert's severity, including the CVSS score on a vulnerability trigger.
• Incident Count Gate: branch on how many incidents the host has opened recently, to catch a flapping server.

Combine them: a critical CVE routes to PagerDuty immediately, while a medium one waits for business hours and lands in Slack - and neither fires while the box is in maintenance.

You do not have to start from an empty canvas. The template gallery ships 46 pre-built workflows across 16 categories - instance metrics, uptime, databases, containers, storage, network, security, hardware, virtualization, queues, IoT, and more. Search it by name, pick one, and it lands on your canvas fully wired with trigger, conditions, and notification already configured.

Templates are a starting point, not a cage. Every node stays editable, so you can change the threshold, add a schedule gate, or swap the notification channel before you publish.