How to run an incident war room for a remote team
An incident war room is the one place where responders work a problem until it is fixed. In an office it was a conference room with a whiteboard. On a remote team it has to be built on purpose: one place for the people responding, the timeline of what happened, and the decisions made along the way.
When it works, anyone who joins late can catch up in a minute, and the postmortem is mostly written by the time the incident closes.
The usual way
Remote incidents tend to spread out fast.
- A video link in a DM. Whoever noticed first starts a call and pastes the link to a few people. Everyone else asks where the call is.
- Threads in three channels. The alert fires in one channel, the debugging happens in another, and customer questions arrive in a third.
- Status updates that land nowhere in particular. Leadership asks for an update in a DM, gets one, and the rest of the team never sees it.
- A timeline rebuilt from memory. The day after, someone scrolls through calls, threads, and DMs to piece together what happened and when.
The fix itself is often quick. The cost is in the scatter.
How to run an incident war room
1. Open one channel per incident
Create a dedicated channel as soon as an incident is declared, with a name that sorts and searches well, such as inc-2026-10-15-checkout-errors. Post the link in the alert channel so everyone knows where to go. All work on the incident happens there.
2. Name an incident lead
One person runs the response. They decide who works on what, call for help, and say when the incident is over. Post their name at the top of the channel and pin it.
3. Keep the timeline in the channel
Every meaningful event goes in the channel as it happens: when the alert fired, what was checked, what was changed, what the result was. Short messages are fine. The channel history becomes the timeline.
4. Give responders a room to talk in
Some debugging is faster out loud. A standing voice room next to the incident channel lets responders talk while they work, and lets others step in and out without asking for a link. Anything decided out loud gets a one-line post in the channel.
5. Post decisions as they happen
"Rolling back the 14:20 deploy." "Disabling the new checkout flag." Write each decision in the channel when it is made, with who made it. A decision log in team chat works the same way during an incident as it does on a normal week.
6. Post a written status on a cadence
Every 30 minutes, or whatever cadence suits the severity, the lead posts a short status: what is known, what is being tried, and when the next update will be. People outside the response read the status instead of interrupting the responders.
7. Close with follow-ups that have owners
When the incident is resolved, list the follow-ups in the channel, each with one owner and a date. Then write the postmortem from the channel history, not from memory.
How Bullpen fits
Bullpen is team chat with walk-in voice rooms and AI helpers on the roster, so the war room is a channel and the room beside it.
The room is already open. Each channel has a walk-in voice room beside it. Responders join the incident channel's room and talk while they work. Anyone catching up can walk in without waiting for an invite.
Wren keeps what was said. In a channel's walk-in voice room, Wren posts notes and action items back to that channel, so decisions made out loud end up in the same timeline as everything else. More on that in recaps that land in the channel.
Scout answers questions from the record. Someone joining late can mention Scout in the channel and ask what has been tried so far. Scout answers from what was actually said and links the message it came from. The same works when writing the postmortem a week later.
Nix keeps the follow-ups moving. When an owner commits to a fix by Friday, mention Nix in that thread and the reminder arrives in the channel on the day. How to keep track of follow-ups in team chat covers the details.
For why a standing room suits this better than a booked call, see walk-in voice vs calendar meetings.
Try it on the next incident
Before the next incident, agree on one rule: every incident gets its own channel, and responders talk in that channel's room.
Start free and set up your first incident channel.