Step 1: Confirm the incident
Validate impact, severity, owners, and the active response policy.
Back to Agent Library
<>IT
Incident investigation
Build an evidence-backed incident timeline and keep response owners aligned as the situation changes.
Overview
Connect alerts, deployments, tickets, runbooks, and operator actions into a live investigation record. The agent separates observations from hypotheses and routes the next approved diagnostic action. The result is a current investigation brief and coordinated response, ready for the accountable team to review and move forward. By keeping source-backed facts, open questions, and ownership together, the team can make the next decision without rebuilding context by hand.
Capabilities
Sequence alerts, changes, tickets, deployments, and human actions with timestamps.
Keep observed facts distinct from possible causes and missing evidence.
Route decisions, owners, and status updates without taking production authority.
Example output
Prepared output: Checkout latency · investigation timeline
Source state: Current approved records retained
Summary
A deployment correlation is visible; production rollback remains with the service owner.
Key findings
- 09:42: Latency threshold breachedReady
- 09:37: Configuration release completedReview
- Service owner: Rollback decision requestedWaiting
Returned to the team
- A source-linked view of the prepared work
- Items that are ready, waiting, or need accountable review
- The next action and owner required to move the outcome forward
Agent workflow
Step 2: Assemble the timeline
Connect telemetry, changes, tickets, and operator actions.
Step 3: Frame hypotheses
Show evidence, possible causes, and the next approved diagnostics.
Step 4: Coordinate response
Route tasks, decisions, and updates to the accountable owners.
Step 5: Preserve the record
Return evidence, actions, current state, and follow-up work.
Put this agent to work