Skip to main content
Log an incident when a problem reaches you before any alert does: a customer email, a teammate in chat, a dashboard that looks wrong. You describe what’s happening, attach what you have, and CloudThinker starts a root-cause investigation as soon as you submit. There’s no way to log an incident without starting an investigation, so this isn’t a way to record something already fixed. You don’t need an alert source connected.

​
Before you start

  • The workspace Admin role. Developers and Viewers can read incidents but can’t log them. Roles are fixed, so there’s no way to grant just this permission. See Roles.
  • A connection to the systems involved, so the investigation can check real data.
  • Optional: screenshots, log exports, or error output to attach. Save logs as .txt, since .log files aren’t accepted.
  • Credits. Each logged incident starts an investigation the moment you submit, even when On duty is Paused, and it’s billed in credits like any other run. See Usage and What starts an investigation.
A logged incident is a real incident. If this is a test, read Test safely first.

​
Log an incident

1

Open the form

Go to Resolve → Investigation and click Log Incident.
2

Pick a template (optional)

A Quick Start Template fills in a title prefix, a description outline, and a severity. Edit anything it fills in. The five templates are fixed, so you can’t add your own. For example, API Outage sets the title to [API Outage] and the context to:
3

Describe the problem

Severity decides whether a Slack war room opens: only when it clears the floor set in Resolve integrations (default High & critical). Whether people are paged is decided by triage (CloudThinker’s check of whether an incident needs a responder now), not severity. See How Resolve decides an incident needs people.
Specific context gives the investigation a better starting point. For example:
4

Submit

Click Log Incident.Success state: the new incident opens selected in Resolve → Investigation, and RCA has already started, even when On duty shows Paused. It shows under AI is handling, with a Watch live button in the header.

​
What happens next

  1. CloudThinker reads your description and attachments, then checks your connected systems to test explanations.
  2. Progress appears in the Investigation timeline as it happens. Click Watch live to follow the conversation.
  3. When it finishes, the incident moves to Needs your decision with a written verdict, a causal graph, and remediation suggestions.
Investigation and RCA explains how to read the result and settle each suggestion.

​
Test safely

A logged incident is a real incident, and it uses credits. Before you log a test:
  • Switch Post incident updates off in Resolve integrations, or point it at a test channel. Otherwise its channel gets a message when the incident opens, changes status, and resolves.
  • Pick Info severity. A Slack war room can’t open for it unless the floor is set to All severities.
  • Whether anyone is paged depends on your On-call setup and what triage decides, not on severity.
  • A test still counts on Resolve insights, for example in the incident total behind Noise reduced. Closing it as False Alarm doesn’t remove it.
  • To close a test incident, click the status badge in the incident header, choose False Alarm, and confirm with Change Status.

​
Log it, or let Pulse catch it?

​
Troubleshooting

​
Next steps

Investigation and RCA

Read the verdict and decide on each fix.

Connect Pulse sources

Get incidents created from your alerts automatically.