Route and escalate IoT alarms via webhook with ACK tiers and Claude triage

Quick overview This workflow receives industrial/IoT alarms via webhook, suppresses duplicate chatter, optionally summarizes the alarm with Anthropic Claude, and routes notifications by severity with tiered ACK-based escalation and timeouts using HTTP endpoints.

How it works Receives an alarm payload through an n8n Webhook endpoint. Normalizes the incoming fields and applies flood suppression to drop repeat alarms within a 5-minute window. If the alarm is suppressed, it records an audit event and stops. If not suppressed, it requests an advisory one-sentence summary, likely cause, and priority from Anthropic Claude and attaches the result to the alarm. Routes the alarm by severity: critical starts a tiered on-call escalation, warning sends a single notification, and info only creates a log entry. For critical alarms, it notifies Tier 1 with an ACK URL, waits up to 5 minutes for an acknowledgment, and escalates to Tier 2 and then Tier 3 if no ACK is received. Logs the final outcome (warning notified, acknowledged at Tier 1/2, or escalated to manager) for audit purposes.

Setup Copy the webhook URL from the Webhook trigger and configure your SCADA/IoT system to POST alarms to it. Create an Anthropic (Claude) HTTP Header Auth credential (send x-api-key plus the required anthropic-version header) and attach it to the Claude request node if you want AI triage. Replace the placeholder notification URLs with your SMS/Slack/Teams/email endpoint(s) and ensure they accept the JSON payload (including ackUrl for critical alarms). Ensure your acknowledgment mechanism calls the provided ackUrl (for example by opening it or POSTing { "ack": true }) within the timeout windows. Connect the audit log steps to your preferred storage (for example Google Sheets or a database) if you want persistent reporting.