Skip to content

The moment it happens

Open an incident ticket and archive its evidence in Drive

Each reported incident opens a Jira ticket, its report is saved to your Drive incidents folder, and the ticket links to the file.

Runs
The moment it happens
Apps
Google Drive, Jira
AI
Optional
Access
Jira create; Drive write

Send this to your assistant

Create a ClickRuntime automation: when an incident is reported at the trigger link, create a Jira ticket in INC, save the report as a file in my Incidents folder in Drive, link the file in the ticket, and post to #incidents.

Paste it into your assistant. It tells you what it will send or change before it runs live.

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A company must keep evidence of security and operational incidents for audits. Reports arrive from different tools and people, and end up scattered across inboxes and chat threads. When the auditor asks, collecting them takes days.

Opening a ticket and saving the report to a single Drive folder for every incident builds the evidence trail as incidents happen. The ticket tracks the response, and the file is ready when the auditor asks.

What you get out of it

  • Evidence in one place

    Every incident report is saved to the same folder, named by ticket. Audits become a matter of sharing a folder.

  • Ticket and file linked

    The Jira ticket links to the saved report. Responders always have the original details.

  • The team is alerted

    A Slack post makes sure someone picks up the incident straight away.

  • A summary if you want it

    With AI turned on, a short summary of the report is added to the ticket. Responders get the gist in seconds.

How it works

What happens, step by step

  1. When an incident is reported, the details are sent to your automation's trigger link.

  2. ClickRuntime creates an incident ticket in Jira.

  3. The full report is saved as a file in your Drive incidents folder, named with the ticket key.

  4. A link to the file is added to the ticket, with a short AI summary if you turn it on.

  5. A message is posted to your #incidents Slack channel.

Before it runs live

  • Connect Google Drive
  • Connect Jira
  • Paste your automation's link into the other app's webhook settings

What you get

RunsThe moment it happens
Open an incident ticket and archive its evidence in Drivejust nowSucceeded
Slack · #incidentsIncident INC-77: Unusual data export from a Northwind admin account at 02:14

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.
  • Your own rules

    Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.

  • Any number of apps

    One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.

  • AI where it helps

    Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.

  • On a schedule or on each event

    Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

  • Act only on the items that match your own rules, and skip the rest
  • Change what the AI looks for, or how it writes the result
  • Add another app, for example also send it to Slack
  • Combine it with other Google Drive and Jira steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.
incident_ticket_with_archived_evidence_in_drive.pyexample
import io, json
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from googleapiclient.http import MediaIoBaseUpload
from clickruntime import on_event, credentials, http, notify, ai

JIRA, SITE = "https://api.atlassian.com/ex/jira/your-cloud-id", "https://acme.atlassian.net/browse/"
adf = lambda text: {"type": "doc", "version": 1, "content": [{"type": "paragraph", "content": [{"type": "text", "text": text}]}]}

def jira(method, path, **kw):
    resp = http.request(method, JIRA + path, headers={"Authorization": f"Bearer {credentials.connection('jira', 'work')}", "Accept": "application/json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)

FOLDER = "incidents-folder-id"

@on_event
def handle(event):
    inc = event.json or {}
    summary = inc.get("title", "Incident")
    try:
        summary = ai.generate(json.dumps(inc)[:6000], system="Summarise this incident in one sentence.", max_output_tokens=60).text.strip()
    except (ai.AINotIncluded, ai.AILimitReached):
        pass
    key = jira("POST", "/rest/api/3/issue", json={"fields": {"project": {"key": "INC"}, "issuetype": {"name": "Task"},
               "summary": f"{inc.get('title', 'Incident')}"[:250], "description": adf(summary)}})["key"]
    drive = build("drive", "v3", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    f = drive.files().create(body={"name": f"{key} {event.received_at[:10]}.json", "parents": [FOLDER]}, fields="webViewLink",
                             media_body=MediaIoBaseUpload(io.BytesIO(json.dumps(inc, indent=2).encode()), mimetype="application/json")).execute()
    jira("POST", f"/rest/api/3/issue/{key}/comment", json={"body": adf(f"Evidence archived: {f['webViewLink']}")})
    notify.slack(f"Incident {key}: {summary}\n{SITE}{key}", channel="#incidents")
    return {"issue": key}

FAQ

Common questions

What format is the report saved in?
As a text or JSON file with everything that was sent, named with the ticket key and date. Attachments sent as links are listed in the file.
Who can see the Drive folder?
Whoever the folder is shared with. Keep incident folders restricted to the people who need them.
Can incidents come from several tools?
Yes. Any tool that can send a web request can report an incident, and each one is handled the same way.
What permissions does it need?
Jira create; Drive write. Nothing else in your accounts is used.
Does it need AI?
No, but you can ask for an AI step (for example a summary). It then uses ClickRuntime's built-in AI allowance.
How many runs does it use?
One run for each event the app sends.
Can I change how it works?
Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Set up “Open an incident ticket and archive its evidence in Drive” from your assistant

Copy the prompt above, or connect your assistant first. Free plan, no credit card.