Investigation and RCA

Root-cause analysis (RCA) is the step where CloudThinker works out why an incident happened. It reads the incident, the alerts behind it, and your connected systems, tests possible explanations, and hands you a written verdict, a diagram of how the failure unfolded, and a list of suggested fixes. You review it and decide what happens next. RCA is the Investigate stage of Resolve. It reads logs, metrics, traces, recent changes, and dependencies through the connections you’ve already set up, and it can only reach what those connections can. Investigation only reads. Any change goes through a runbook and your Approvals settings. For what the model sees and how secrets are handled, see Data protection.

Before you start

At least one connection to the systems involved, such as your cloud account, Kubernetes cluster, or monitoring tool. RCA can only check what it can read.
The workspace Admin role to start investigations, settle suggestions, and change an incident’s status (including closing it). Developers and Viewers can read results. See Roles.
Credits. Each investigation is agent work, billed in credits like any other run, including ones that start automatically. Watch spend on Usage, and cap a workspace with Credit limits. To stop automatic runs, turn Auto-investigate off on a webhook or pause On duty. See What starts an investigation.

How an investigation starts

Incident came from	When RCA starts
Pulse (an alert source)	Automatically when triage opens or reopens the incident, while On duty is on and the webhook’s options allow it. What starts an investigation has the full rules.
Log Incident (a person)	Right away, as soon as you submit the form, even while On duty is Paused.
An incident with no investigation yet. It waits in Not started with the reason Ready to investigate.	When you click Investigate.
An incident set to Investigating that has never had an investigation, for example because someone picked Investigating from the status badge. It waits in Not started with the reason No investigation run.	When you click Investigate.

Run an investigation

Open the incident

Go to Resolve → Investigation and select the incident from the queue.

Start RCA if it hasn't started

If the incident has never been investigated, click Investigate in the incident header.Success state: the incident moves to AI is handling and a Watch live button appears in the header.

Follow along (optional)

Click Watch live to open the conversation where CloudThinker is working. You’ll see each check it runs as it runs. The Investigation timeline on the incident also updates live.

Read the verdict

When analysis finishes, the incident moves to Needs your decision. Its row in the queue shows the reason, such as Cause found for an incident with status Identified. Investigation outcomes lists every status and where it lands. Read the result explains each section of the page.If the timeline stops adding steps and Watch live shows no activity, see Investigation stuck.

Settle each suggestion

Mark each item under Remediation as done or dismissed. See Settle each remediation suggestion.

Close the incident

Click the status badge in the incident header, pick Resolved or False Alarm, and confirm with Change Status. Only workspace Admins can change status. Other roles see the badge without a menu.

Current status	Closing options in the menu
Open, Acknowledged, Investigating, Identified	Resolved or False Alarm
On Hold	Resolved only. To mark it False Alarm, move it to Investigating first.
Not Found	Neither. The menu offers Investigating only. To close it, pick Investigating, then open the badge again and choose Resolved or False Alarm.

Success state: the incident moves to the Resolved or Dismissed group.

The investigation queue

Resolve → Investigation groups incidents by what they need from you:

Group	What’s in it
AI is handling	An investigation is running
Needs your decision	A verdict is ready, the investigation paused for input, or the checks were inconclusive
Not started	No investigation has run yet, or one is queued (reason Queued to start). Click Investigate to start one.
Resolved	Closed as Resolved or Auto-resolved
Dismissed	Closed as False Alarm by a person (reason False alarm), or CloudThinker’s triage judged the alert needs no action (reason No action needed)

Read the result

The incident page puts the answer first and the supporting material below it.

Section	What it tells you
Current assessment	The written verdict, an evidence label (below), and how long it took to identify the root cause. Shows Still investigating while a session is running.
How it happened	A causal graph from the first failure to the visible impact
CloudThinker recommends a severity change (between How it happened and Remediation)	Appears when CloudThinker thinks the severity is wrong. It shows the current and suggested levels as two badges. Click Change to the suggested level, or Keep the current one.
Remediation	Suggested fixes, each with a priority: Critical, High, Medium, or Low. Work from Critical down.
Detection	One line on how early the incident was caught, for example “First monitor alert under 1 min after impact start”. It also says whether a Detector fired, or that no Detector watches that service, with an Open Detectors link.
Full analysis	The complete written analysis
Investigation timeline	Every step, newest first, including each explanation tested and whether it was confirmed or ruled out
Affected services	Services and dependencies involved
Duplicate webhooks	Repeat deliveries of the same alert, when there were any. Many duplicates point at a source that retries: check the tool’s retry setting, or the fields Pulse uses to spot duplicates in Limits and responses.
Was Resolve’s diagnosis right?	Thumbs up or down on the verdict. These answers feed the Accuracy & trust tab. See Mark a diagnosis right or wrong.

Here’s what a short result can look like:

Current assessment                                    Verified
checkout-api pods ran out of memory after payment-client v2.3 doubled
its connection pool. Restarts cleared it for minutes at a time.

Remediation
High    Roll back payment-client to v2.2 on prod-eu
Medium  Set a pool size limit in the payment-client config

Evidence labels

The label next to Current assessment says how well the root cause is backed:

Label	Meaning	How to treat it
Verified	Confirmed against data from your systems, shown in the Investigation timeline	Review the timeline steps it rests on, then act. Any change still runs through a runbook and your Approvals settings.
Inferred	Reasoned from the evidence, not directly confirmed	Check the timeline before acting
Cause unproven	The verdict rests on an assumption	Treat it as a lead. Add access or context and investigate again.

Cause unproven is a verdict with weak support. Not Found is a status that means no verdict at all.

Settle each remediation suggestion

Hover a suggestion in Remediation, open its More remediation actions menu, and choose:

Action	Use it when	Add a note about
Mark as Done	Your team did the work	What you actually did
Dismiss	It doesn’t apply or isn’t worth doing	Why

The note is optional and stays on the suggestion for anyone reviewing the incident. Settling is final: the menu disappears once a suggestion is marked, and there’s no undo. A later investigation session doesn’t overwrite it either.

Investigation outcomes

Each status maps to a queue group, and the queue row shows the reason:

Status	Meaning	Queue group	Reason shown
Open, Acknowledged	No outcome yet. Acknowledged means a responder owns it.	Not started before any investigation, Needs your decision after one finishes	Ready to investigate, then Investigation complete
Identified	A root cause was found	Needs your decision	Cause found
On Hold	Waiting for information, access, or a decision from a person	Needs your decision	Paused
Not Found	The available evidence didn’t support a root cause	None. The queue doesn’t list it.
False Alarm	The alert wasn’t a real problem	Dismissed	False alarm
Resolved	Fixed and closed with a person involved	Resolved	Validated
Auto-resolved	Fixed and closed by the agent with nobody involved	Resolved	Auto-resolved

An incident can also sit in Needs your decision with one of these reasons:

Reason	Meaning	What to do
Investigation complete	The investigation finished, but the status didn’t move past Open, Acknowledged, or Investigating	Read Full analysis, then set the status yourself
Investigation stopped	The session failed. The incident page shows an Analysis Failed panel.	Click Retry Analysis in that panel
Investigation cancelled	The session was cancelled before it finished	Ask again in the conversation, or close the incident
Checks incomplete	Triage couldn’t decide whether the alert needs action	Read the source alerts with View source context, then set the status yourself

Known limitation: a Not Found incident drops out of the queue. No queue group or filter lists it. Before you leave its page, either move it on or copy its URL:

To keep working on it, add the missing connection, click the status badge, and choose Investigating. An incident that was investigated before returns to Needs your decision, not Not started, where you can investigate again.
To drop it, choose Investigating, then open the badge again and pick Resolved or False Alarm.
To come back later, bookmark the incident’s URL. That’s the only way back to it.

Re-investigation

An incident has one investigation record and one Investigation timeline. A session is one investigation conversation. Asking again in that conversation stays in the same session, so no new session marker appears. A later session, such as one that starts when triage matches a new alert to the incident, begins with a Session started marker. Earlier sessions stay available under More actions → Earlier sessions. The Investigate button only appears before the first investigation. To investigate again with new access or context:

Add what was missing

Add the missing connection, or note the context you want CloudThinker to use.

Open the conversation

In the incident header, open More actions → Open AI Conversation.

Ask it to look again

Say what changed. For example: I've connected the prod-eu Datadog account. Re-check the root cause.Success state: checks it records appear as new steps in the Investigation timeline. If the root cause changes, a Root cause revised entry appears and Current assessment updates. If neither appears, the reply didn’t change the incident.

If the session failed (queue reason Investigation stopped), the incident page shows an Analysis Failed panel under Current assessment. Click Retry Analysis there. Admin only.

Correlated incidents

When several alerts share a likely cause, Resolve groups them under one parent incident and runs a single RCA there. Opening a grouped alert shows a Part of a Correlated Group card:

Option	What it does
View Parent Analysis	Opens the parent incident that owns the investigation
Promote to Standalone	Detaches the alert into its own incident. After you confirm, choose whether to start RCA on it now or leave it for later. Admin only.

Grouping starts in Pulse. To make related alerts group correctly, map Resource ID Path on each webhook so repeats of one fault group, and Service Path to a single service name so different alerts about one service can join. See How signals join a cluster. From the incident’s More actions menu:

Download analysis PDF saves the analysis as a PDF.
Open AI Conversation opens the full investigation conversation, where you can ask follow-up questions.
View source context shows the alerts and Pulse data the incident came from.

Troubleshooting

Problem	Fix
No Investigate button	The incident already has an investigation (see Re-investigation), a session is running, or it’s part of a correlated group (use View Parent Analysis). It also needs the Admin role.
An alert never became an investigated incident	Check On duty, the webhook’s Auto-investigate and minimum severity against What starts an investigation. To start one now, click Escalate and Send to triage on its cluster in Resolve → Pulse.
An incident stays in Not started	Click Investigate.
Verdict is Cause unproven or Not Found	RCA couldn’t read enough. Add the missing connection, then ask again in the conversation. A Not Found incident must be moved back to Investigating first. See the Not Found warning and Re-investigation.
Stuck in On Hold	Open the conversation with Open AI Conversation and answer what CloudThinker asked for.

Next steps

Log an incident

Start an investigation from a human report.

Use runbooks

Turn a verdict into a scoped, approved fix.

Control automatic RCA

Set On duty and live progress updates.

Incident memory

See how lessons carry into later investigations.

Get started

Set up

Work incidents

Learn and improve

Help

Before you start

How an investigation starts

Run an investigation

The investigation queue

Read the result

Evidence labels

Settle each remediation suggestion

Investigation outcomes

Re-investigation

Correlated incidents

Troubleshooting

Next steps

Log an incident

Use runbooks

Control automatic RCA

Incident memory

​Before you start

​How an investigation starts

​Run an investigation

​The investigation queue

​Read the result

​Evidence labels

​Settle each remediation suggestion

​Investigation outcomes

​Re-investigation

​Correlated incidents

​Share or export the result

​Troubleshooting

​Next steps

Log an incident

Use runbooks

Control automatic RCA

Incident memory

Before you start

How an investigation starts

Run an investigation

The investigation queue

Read the result

Evidence labels

Settle each remediation suggestion

Investigation outcomes

Re-investigation

Correlated incidents

Share or export the result

Troubleshooting

Next steps