*Workflows › Guides*

# Escalate incidents left unattended for 24 hours

> Check again after a delay. When an incident is created, the workflow waits 24 hours and looks at it again, so it only raises the alarm for the ones that are still open.

> **Before you start:** This is the template "Notify of incidents still unresolved after 24 hours". You fill in one blank: the Slack channel. The texts a template writes (messages, task titles, email bodies) are in Spanish as the catalog has them: edit them to your language before you go live.

The template's reference page, with its trigger, steps and requirements: [Notify of incidents still unresolved after 24 hours](https://docs.filmo.io/workflows/reference/templates/incident-unattended-escalation).

## The steps

| # | Step | Setting |
| --- | --- | --- |
| Trigger | Event: incident created | Publishes the incident (its identifier, title, severity…). |
| 1 | «Wait» | 24 hours. A relative wait: up to 30 days is allowed. |
| 2 | Find incident | Incident id = the incident of the trigger. Gives its current status. |
| 3 | «Switch» | Branches on the status: open, waiting, repairing. Each posts the same message to the workshop on Slack ("Incident <id> is still unresolved after 24 hours"). The default lane is empty. |

## Build it

1. **Start from the template** «New workflow», «Start from a template».
2. **Pick the Slack channel** In each of the three branches, open «Post a message» and choose the workshop's channel.
3. **Publish and activate** «Publish and activate».

## Why three identical branches

A condition compares one value, so "open, waiting or repairing" cannot be a single test. The workflow has one branch per status, with the same action in each. A resolved or written-off incident matches none, falls to the empty default lane and produces no message.

## Compare it with escalating at once

The template "Incident → escalation by severity" uses the same trigger but acts immediately: a switch on the severity (blocking, high, low) alerts Slack, creates tasks, emails someone and asks Neo for the item's incident history. Use that one when severity decides the urgency and this one when time does. You can install both.

> **Warning:** A run that is waiting is not cancelled when the incident is closed: it wakes, reads the new status, and falls to the default lane. That is intended.

More on this: [Waits and dates](https://docs.filmo.io/workflows/waits-and-dates), [Conditions](https://docs.filmo.io/workflows/conditions#switch-step).

---

Canonical URL: https://docs.filmo.io/workflows/guides/unattended-incidents  
Last updated: 2026-10-09