> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Investigate a Checkout Incident End to End > Follow one production incident from the first alert to a verified root cause, an approved fix, and a closed incident in Resolve. A checkout error alert fires, and Resolve takes it from there: it groups the alerts, investigates, and hands you a root cause with the evidence attached. This walkthrough follows that one incident until you close it. ## The scenario At 14:05, your monitoring tool reports that `checkout-api` in production is returning 5xx errors. A deploy went out 20 minutes earlier. The alert repeats every minute, and a database alert fires next to it. You want to know whether the deploy caused it, roll back only if it did, and keep a record the team can trust. ## Prerequisites * An alert source sending to Resolve, such as Datadog, Grafana, or CloudWatch. See [Resolve integrations](https://docs.cloudthinker.io/guide/incident/integrations.md). To try this with a test alert, follow the [Resolve quickstart](https://docs.cloudthinker.io/guide/incident/quickstart.md). * [Connections](https://docs.cloudthinker.io/guide/connections/overview.md) for the systems behind checkout, for example your cloud account, your Kubernetes cluster, and your observability tool. Resolve can only verify what it can read. * The workspace **Admin** role to start investigations and close incidents. See [Roles](https://docs.cloudthinker.io/guide/security/roles.md). ## Walkthrough **1. Check that Resolve is on duty** Go to **Resolve → Investigation** and look at the switch in the page header. **On duty** means CloudThinker investigates alerts from Pulse on its own. **Paused** means Pulse keeps detecting and grouping alerts and still files incidents as **Open**, but no investigation starts on its own until someone clicks **Investigate**. An incident a person logs or escalates still investigates right away. See [What starts an investigation](https://docs.cloudthinker.io/guide/incident/settings.md#what-starts-an-investigation). **2. Watch the alerts become one incident** Go to **Resolve → Pulse**. The repeated 5xx alerts and the database alert land in one cluster instead of a page each. Triage then opens one incident for the cluster. **What you should see:** the cluster moves to the **Routed** lane, and a new incident appears on **Resolve → Investigation** under **AI is handling**. **3. Follow the investigation live** Open the incident and click **Watch live**. The conversation shows each check CloudThinker runs: recent deploys, error rates, pod restarts, database connections. The **Investigation timeline** on the incident fills in as it goes. **4. Read the verdict** When the incident moves to **Needs your decision**, read **Current assessment** and its evidence label. **Verified** means the cause was confirmed against data from your systems. **Inferred** or **Cause unproven** means you check the timeline before acting. **What you should see:** a row reading **Cause found**, a causal graph under **How it happened**, and fixes under **Remediation**, each with a priority. ```text theme={null} Current assessment Verified checkout-api v4.2 opens a new database connection per cart item. The pool ran out 18 minutes after the deploy, and checkout returned 5xx. Remediation High Roll back checkout-api to v4.1 in production Medium Reuse the pooled connection in the cart loader ``` **5. Ask follow-up questions** Open **More actions → Open AI Conversation** and test the verdict before you act on it: ```text theme={null} Show the checkout-api error rate and database connection count for the hour around the v4.2 deploy, as one chart. Did any other service call the same database in that window? If so, rule it out with data. ``` **What you should see:** answers with numbers from your connections. A new check that changes the cause adds a **Root cause revised** entry to the timeline. **6. Approve the rollback** Ask for the fix in the same conversation: ```text theme={null} Roll back checkout-api in production to v4.1 and confirm the 5xx rate drops back to its baseline. ``` Every change an agent makes goes through your workspace's [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md) first. On the default **Auto · Rules + AI · Ask me** mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on [Rule enforcement](https://docs.cloudthinker.io/guide/approvals/rules.md#troubleshooting) for your workspace. Choose **Manual** to approve every change yourself. A rollback also needs credentials that permit it, and **Allow writes** on in the connection's detail panel. If an approval card appears, answer it in chat or in [Google Chat](https://docs.cloudthinker.io/guide/google-chat-integration.md). From Slack or Microsoft Teams, follow the link back to the web app to answer it. **7. Settle and close** Under **Remediation**, open each suggestion's **More remediation actions** menu and choose **Mark as Done** or **Dismiss**, with a note on what you did. Answer **Was Resolve's diagnosis right?** with a thumbs up or down. Then click the status badge in the incident header, pick **Resolved**, and click **Change Status**. **What you should see:** the incident moves to the **Resolved** group, and your verdict counts toward **Resolve → Insights**. ## What made this work * **Pulse grouped the noise.** Repeated alerts joined one [cluster](https://docs.cloudthinker.io/guide/pulse/clusters.md), so one incident opened instead of many. * **The connections set the ceiling.** Resolve verified the cause because it could read the deploy history, the cluster, and the database metrics. * **The verdict showed its evidence.** The label and the [investigation timeline](https://docs.cloudthinker.io/guide/incident/root-cause-analysis.md) told you how far to trust it before you acted. * **The fix went through Approvals.** Your [Rules and Approval mode](https://docs.cloudthinker.io/guide/approvals/overview.md) decided whether the rollback ran or waited for a person. * **Your feedback counts.** Marking the diagnosis right or wrong feeds [Insights](https://docs.cloudthinker.io/guide/incident/insights.md). ## Next steps > **[Read an investigation](https://docs.cloudthinker.io/guide/incident/root-cause-analysis.md)** > > What every part of the result means, and how to investigate again. > **[Connect a real source](https://docs.cloudthinker.io/guide/incident/integrations.md)** > > Point Datadog, Grafana, PagerDuty, or CloudWatch alerts at Resolve. > **[Set up On-call](https://docs.cloudthinker.io/guide/incident/oncall.md)** > > Bring responders into an Incident Room when an incident needs people. > **[Approval Rules](https://docs.cloudthinker.io/guide/approvals/rules.md)** > > Name which writes may run alone, which ask first, and which never run. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.