Grafana 13.3 brings Notebooks to self-managed incident investigations

A new option for self-managed Grafana teams

Grafana released 13.3.0 on October 27, 2026, bringing Notebooks to self-managed deployments in public preview. A notebook combines editable notes, queries and visualizations to preserve investigative context and improve handoffs. Teams sharing disconnected dashboard screenshots now have an option inside their observability tool.

This report was prepared on October 28. Notebooks was announced for Cloud on October 20; the fresh development is the October 27 self-managed release, not a recycled Cloud announcement. Follow the dashboard.notebooks feature-toggle guidance and retain the expectations appropriate to a preview.

Pair the chart with the question and reasoning

The versioned documentation describes adding dashboard panels, Explore queries and Grafana Assistant findings. Users can add text, code and headings and arrange the investigation so another person can understand it. Basic notebook use does not require an AI-generated conclusion.

For example, a team investigating errors after deployment can record the question, time range and query beside the chart. A handoff should distinguish checked facts, hypotheses and next actions. A graph alone does not prove deployment caused an issue, particularly when queries or time windows change.

Adding or updating a panel in a notebook does not update its source dashboard. Keep that distinction explicit so an investigative edit is not mistaken for a change to the main operational view.

A time lock does not preserve query results

A panel can have a time range independent of the notebook. Last 30 minutes remains relative to when it is viewed. Use absolute start and end times, and clarify the timezone when necessary, to preserve the intended investigation window.

Even an absolute time lock does not snapshot query results. Retention expiry, reprocessing or source permissions can change what is returned. Fixed evidence requires an appropriate retention or capture process; a dynamic notebook is not an immutable record.

Friday Works recommends recording source names, queries, timestamps and filters sufficient for authorized rechecking. Internal tooling is not a reason to paste secrets, tokens, personal information or sensitive logs into notes.

A shared link grants no additional data access

Recipients still need permission to view the notebook and query its data sources. Viewers can read applicable notebooks by default, while Editors and Admins can create, edit and delete under their permissions. An administrator opening a link does not prove that a lower-privileged colleague can see the same evidence.

Markdown exports represent panels as JSON blocks rather than rendered visualizations. PDF can retain rendered charts when a compatible image renderer is available. Validate the renderer, data permissions and actual file instead of promising identical exports from every installation.

Notebooks save edits automatically. Resolve Save failed and retry before leaving; undo does not restore a deleted notebook. These operational details matter in a shift handoff.

Pilot a synthetic incident before changing the on-call process

Friday Works suggests a two-person trial: one investigator records a synthetic incident, then an appropriately authorized recipient explains the established facts and next action. Compare it with the existing ticket or runbook process, recording permission failures, changing data and measured handoff time before claiming savings.

Assistant and Incident Response Management integrations have separate product and permission conditions. A Grafana upgrade does not establish access to every AI capability or authorize notifications to responders. Test actions affecting other people only under the operations team’s approval.

Move forward when the record is reproducible, avoids data leakage and communicates evidence limits. If data access and retention are poorly controlled, address those prerequisites before relying on notebooks for post-incident review.