Skip to main content
A checkout error alert fires, and Resolve takes it from there: it groups the alerts, investigates, and hands you a root cause with the evidence attached. This walkthrough follows that one incident until you close it.

​
The scenario

At 14:05, your monitoring tool reports that checkout-api in production is returning 5xx errors. A deploy went out 20 minutes earlier. The alert repeats every minute, and a database alert fires next to it. You want to know whether the deploy caused it, roll back only if it did, and keep a record the team can trust.

​
Prerequisites

  • An alert source sending to Resolve, such as Datadog, Grafana, or CloudWatch. See Resolve integrations. To try this with a test alert, follow the Resolve quickstart.
  • Connections for the systems behind checkout, for example your cloud account, your Kubernetes cluster, and your observability tool. Resolve can only verify what it can read.
  • The workspace Admin role to start investigations and close incidents. See Roles.

​
Walkthrough

1

Check that Resolve is on duty

Go to Resolve → Investigation and look at the switch in the page header. On duty means CloudThinker investigates alerts from Pulse on its own. Paused means Pulse keeps detecting and grouping alerts and still files incidents as Open, but no investigation starts on its own until someone clicks Investigate. An incident a person logs or escalates still investigates right away. See What starts an investigation.
2

Watch the alerts become one incident

Go to Resolve → Pulse. The repeated 5xx alerts and the database alert land in one cluster instead of a page each. Triage then opens one incident for the cluster.What you should see: the cluster moves to the Routed lane, and a new incident appears on Resolve → Investigation under AI is handling.
3

Follow the investigation live

Open the incident and click Watch live. The conversation shows each check CloudThinker runs: recent deploys, error rates, pod restarts, database connections. The Investigation timeline on the incident fills in as it goes.
4

Read the verdict

When the incident moves to Needs your decision, read Current assessment and its evidence label. Verified means the cause was confirmed against data from your systems. Inferred or Cause unproven means you check the timeline before acting.What you should see: a row reading Cause found, a causal graph under How it happened, and fixes under Remediation, each with a priority.
5

Ask follow-up questions

Open More actions → Open AI Conversation and test the verdict before you act on it:
What you should see: answers with numbers from your connections. A new check that changes the cause adds a Root cause revised entry to the timeline.
6

Approve the rollback

Ask for the fix in the same conversation:
Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.A rollback also needs credentials that permit it, and Allow writes on in the connection’s detail panel. If an approval card appears, answer it in chat or in Google Chat. From Slack or Microsoft Teams, follow the link back to the web app to answer it.
7

Settle and close

Under Remediation, open each suggestion’s More remediation actions menu and choose Mark as Done or Dismiss, with a note on what you did. Answer Was Resolve’s diagnosis right? with a thumbs up or down. Then click the status badge in the incident header, pick Resolved, and click Change Status.What you should see: the incident moves to the Resolved group, and your verdict counts toward Resolve → Insights.

​
What made this work

  • Pulse grouped the noise. Repeated alerts joined one cluster, so one incident opened instead of many.
  • The connections set the ceiling. Resolve verified the cause because it could read the deploy history, the cluster, and the database metrics.
  • The verdict showed its evidence. The label and the investigation timeline told you how far to trust it before you acted.
  • The fix went through Approvals. Your Rules and Approval mode decided whether the rollback ran or waited for a person.
  • Your feedback counts. Marking the diagnosis right or wrong feeds Insights.

​
Next steps

Read an investigation

What every part of the result means, and how to investigate again.

Connect a real source

Point Datadog, Grafana, PagerDuty, or CloudWatch alerts at Resolve.

Set up On-call

Bring responders into an Incident Room when an incident needs people.

Approval Rules

Name which writes may run alone, which ask first, and which never run.