Step 1: Confirm the incident
Validate impact, severity, owners, and the active response policy.
Back to Agent Library
<>IT
Incident investigation
A current investigation brief and coordinated response
Overview
Connect alerts, deployments, tickets, runbooks, and operator actions into a live investigation record. The agent separates observations from hypotheses and routes the next approved diagnostic action.
Prepared result
Checkout latency · investigation timeline
A deployment correlation is visible; production rollback remains with the service owner.
- 09:42Ready
Latency threshold breached
- 09:37Review
Configuration release completed
- Service ownerWaiting
Rollback decision requested
Prepared using fictional business records.
What it can handle
Reconstruct the timeline
Sequence alerts, changes, tickets, deployments, and human actions with timestamps.
Frame grounded hypotheses
Keep observed facts distinct from possible causes and missing evidence.
Coordinate response
Route decisions, owners, and status updates without taking production authority.
How it works
The path from request to result adapts to the available information, approved actions, and decisions that need review.
Step 2: Assemble the timeline
Connect telemetry, changes, tickets, and operator actions.
Step 3: Frame hypotheses
Show evidence, possible causes, and the next approved diagnostics.
Step 4: Coordinate response
Route tasks, decisions, and updates to the accountable owners.
Step 5: Preserve the record
Return evidence, actions, current state, and follow-up work.
