How It Works
Investigation Completes
When an RCA investigation identifies a root cause, CloudThinker automatically extracts key learnings — the problem, root cause, remediation steps, affected services, and confidence level.
New Incident Occurs
When a new incident triggers an RCA investigation, CloudThinker searches for similar past incidents across your workspace.
What Gets Captured
Each completed investigation automatically saves:| Information | Example |
|---|---|
| Root Cause | ”Connection pool exhaustion due to leaked database connections” |
| Remediation Steps | Prioritized actions the AI recommended |
| Affected Services | Services involved in the incident |
| Severity | Incident severity level |
| Confidence | How certain the AI was about the root cause |
Recall Indicator
When an investigation uses knowledge from past incidents, you’ll see a badge on the RCA results:Informed by N similar incidentsThis tells you the AI referenced prior investigations to guide its analysis. Hover over the badge for details.
When Memory Helps Most
Recurring Issues
Database connection problems, memory leaks, deployment regressions — patterns that repeat get diagnosed faster each time.
Similar Root Causes
A CPU spike in Service A caused by a config change? Next time a CPU spike hits Service B, the AI knows to check configurations first.
Team Knowledge Retention
When engineers leave or rotate, their debugging insights stay in the system.
Faster Resolution
Instead of starting from scratch, the AI begins with informed hypotheses based on what worked before.
How It Improves Over Time
Incident Memory gets smarter as your team uses CloudThinker:- Reinforcement — When the same root cause appears across multiple incidents, that pattern is strengthened and prioritized in future searches
- Supersession — Re-investigating an incident replaces the old memory with updated findings, keeping knowledge current
- Deduplication — Identical findings are automatically merged rather than duplicated
Configuration
Incident Memory is enabled by default when your workspace has the memory feature active. No additional setup is needed.Incident Memory only captures learnings from RCA investigations that reach a conclusion (root cause identified, false alarm, or not found). Cancelled or failed investigations are not stored.
Best Practices
- Provide detailed incident descriptions — richer context helps the AI find better matches from past incidents
- Run RCA to completion — investigations that reach a disposition contribute the most useful memories
- Connect your topology — incidents with mapped affected services produce more precise future matches
- Re-investigate when needed — running a second RCA on the same incident updates the memory with better findings