Resolve

Finds the root cause. In minutes. Resolve is the Frontier Investigation Agent for production incidents. It takes the alerts your tools already send, drops the noise, investigates what’s left to a root cause, and brings in people only when an incident needs them. To start, you need one alert source. For a root cause CloudThinker can verify, also connect the cloud or observability account the alerts are about.

How it works

Inside Resolve, an alert moves through four stages. They’re Resolve’s own steps of the platform loop described in the AgenticOps field guide.

Stage	What happens	Where you see it
1. Detect	Pulse, the detection layer, suppresses known noise and groups related alerts into clusters, so one outage is one item.	Resolve → Pulse
2. Investigate	CloudThinker triages each actionable cluster, opens or reopens an incident, and runs a root-cause analysis (RCA) across your connected systems.	Resolve → Investigation
3. Respond	Once you turn on On-call, it opens an Incident Room for the responders when people are needed. It’s off by default. Every fix CloudThinker runs goes through Approvals, including runbook commands. A new workspace starts on Auto · Rules + AI · Ask me: a write no Rule allows runs only if AI judges it safe, and otherwise waits for a person. A runbook’s Require Approval effect applies only where Policies is on (see Runbooks). Choose Manual to approve every change yourself. See what you get out of the box.	Incident Room, Slack war room
4. Remember	CloudThinker writes incident memory that later investigations read at the start. There’s no screen to view or edit it: CloudThinker corrects entries itself as new evidence comes in.	In later RCA results that cite a past incident

Not every incident reaches every stage. An investigation can end without a root cause, and a Track only incident (real but not urgent, so no one is paged) stays in the queue unless a person raises it.

Set up in this order

You need the workspace Admin role to change Resolve settings and integrations. See Roles.

Connect an alert source. Point a monitoring tool at Resolve, or try a test source first with the quickstart. Connect alert sources finds the path your tool takes; Connect Pulse sources has the steps.
Decide on On duty. It’s on in a new workspace, so CloudThinker triages and investigates on its own. Pause it while you connect and tune your first real source, then turn it back on. See below.
Set up On-call. Pick responders and, optionally, a Slack war room. See On-call.
Review your Approvals policy. It decides which fixes run on their own and which wait for a person. See Approvals.

Start from the Overview

Open Resolve → Overview to see what needs you now and what Resolve handled alone.

Tile	What it counts
Needs your decision	Incidents waiting on a person: Cause found, Paused (CloudThinker asked you something and waits for the answer), Investigation complete, Checks incomplete, or an investigation that stopped or was cancelled. See the investigation queue.
Awaiting your approval	Runbooks staged and blocked on an approval decision
Critical & high open	Unresolved incidents at the top two severities
AI is handling	Incidents being investigated right now, no action needed

Each tile opens the matching slice of the Investigation queue. The page also shows the funnel from alerts to incidents. If a connected source stops sending, a banner says so, so a broken feed doesn’t look like a quiet system.

Funnel step	Meaning
Event	One raw notification from a source, such as a CloudWatch alarm
Signal	An event that survived noise suppression
Cluster	A group of related signals that Pulse treats as one problem
Incident	The record an actionable cluster is filed as, and the record a person logs directly. CloudThinker investigates it.

Pulse covers the first three in detail.

Choose who starts investigations

CloudThinker’s autonomy switch sits in the header of Resolve → Investigation, and its label shows its state: On duty or Paused. It isn’t your human on-call rotation. It’s on in a new workspace, and only a workspace Admin can change it. Resolve settings lists every other Resolve control.

Switch state	Behavior
On duty	CloudThinker detects, triages each actionable cluster, and investigates on its own. Each triage and investigation is a run that uses credits, so a noisy source costs more.
Paused	Pulse keeps detecting and grouping alerts, and an actionable cluster is still filed as an incident with status Open for you to review. CloudThinker doesn’t triage or investigate on its own — each incident waits until someone clicks Investigate. Incidents a person logs or escalates still investigate right away.

Per-webhook options, logged incidents and manual starts change this. What starts an investigation has the full rules in one table. Send to triage, Investigate and Log Incident always work, whichever way the switch is set.

What you can do

Job	What it covers	Read
Try it end to end	Send a test alert and follow it from Pulse to an incident	Resolve quickstart
Follow a walkthrough	One production incident, from the first alert to a verified root cause, an approved fix, and a closed incident	Investigate a checkout incident end to end
Connect alert sources	Which path your tool takes into Resolve: a webhook, AWS polling, or a chat channel	Connect alert sources
Choose what Resolve posts back	Follow-up tickets, postmortems, chat updates, and the readiness badge on each platform	Integrations
Work the alert feed	Lanes, clusters, Escalate, Attach to incident, snooze	Pulse
Read a root cause	Verdict, confidence, evidence, timeline, remediation suggestions	Investigation and RCA
Bring people in	Responders, paging, the Incident Room, and the Slack war room	On-call
Log something Pulse didn’t see	A customer report or an operator hunch	Log an incident
Govern fixes	Which actions run on their own and which wait for a person	Approvals
Add fix procedures	Your written procedures from Confluence, GitHub, GitLab, or Markdown, read during RCA. Runbooks still work; the sidebar marks them Legacy.	Runbooks
Catch what your alerts miss	Checks CloudThinker writes and backtests for incidents no alert rule caught, running beside your own alerts	Detectors
Measure results	Trends, accuracy, and per-service reliability	Insights
Tune behavior	Every Resolve control and where it lives, including live progress updates	Settings

Get started

Resolve quickstart

Send a test alert and watch Pulse turn it into an incident in about 10 minutes.

Connect a source

Point an existing monitoring tool at Resolve.

Set up On-call

Choose who joins the Incident Room when an incident needs people.

Read an investigation

Learn what each part of an RCA result means and how to act on it.

Get started

Set up

Work incidents

Learn and improve

Help

How it works

Set up in this order

Start from the Overview

Choose who starts investigations

What you can do

Get started

Resolve quickstart

Connect a source

Set up On-call

Read an investigation

​How it works

​Set up in this order

​Start from the Overview

​Choose who starts investigations

​What you can do

​Get started

Resolve quickstart

Connect a source

Set up On-call

Read an investigation

How it works

Set up in this order

Start from the Overview

Choose who starts investigations

What you can do

Get started