Using this page with CloudThinker. Paste this page’s URL into a chat and try:
- “Explain the suppression layers on this page to me like I am new to on-call.”
- “Quiz me on the difference between a trigger, a root cause and a contributing factor.”
- “Help me outline my Day 02 incident report following the five criteria on this page.”
Rules of the room
- 150 minutes. Learn 35, a keynote 25, Practice 30 with no break, Share 20.
- The Kubernetes demo cluster is read-only. The agent can inspect. It cannot restart, scale, deploy or edit anything, and it cannot read secrets.
- You never enter credentials. You pick the demo environment and click Use demo. Nothing to fill in.
- The agent recommends. People decide. No fix is applied today.
- Redact. Anything that identifies a real system comes out of the report before it is shared or shown on screen.
- One report file per team. Submitted before Share starts.
Learn · 35 minutes
Day 01 gave you a boundary for the agent. Day 02 starts one step earlier, with the boundary you never set for the signal.1. You cannot investigate what you cannot rank
A production night does not hand you one incident. It hands you a stream. One access finding fires on a production role at 02:14, 180 AccessDenied lines land in the audit log in the same minute, three near-identical alerts arrive from three services, and by 02:16 the on-call has five pages open for one problem. In one CloudThinker workspace, an overnight stream of roughly 13,000 raw events collapses to about 40 clusters worth acting on. The investigation is not the hard part at that hour. Choosing what to investigate is. Every team already has an answer to alert volume, and all four cost something:
Each of those is a decision about what you agree to lose. They are usually made once, informally, and never written down. That is the same governance gap Day 01 opened, pointed at the signal instead of at the agent.
2. Noise dies in layers, not in one filter
Reduction is a pipeline with four steps: ingest, suppress, correlate, then classify and route. Almost everything happens in the second step, and it is not one filter. It is eight, and they run in priority order. The first one to match wins, so the order of the layers is the policy.
Cascade removes the most, and it is also the one that will hide a real outage if the root signal it collapsed onto was wrong. Severity normalization says something uncomfortable but true: the severity stamped on an event by the tool that sent it is a guess, and you are allowed to re-grade it.
The layers CloudThinker uses are described in Pulse overview. The teaching point is not the product. It is that reduction is layered and ordered whatever tool you use.
3. Every suppression rule needs an escape hatch
Silence has to expire and it has to be overridable, or it becomes a blind spot nobody remembers creating.
A suppressed event is stored, not deleted, so you can still ask what the system silenced last night.
4. Reduction is what makes the agent affordable
Only now does the investigator agent arrive, and it arrives for an economic reason rather than a magical one. One CloudWatch alarm in a CloudThinker workspace flapped 18 times in 53 minutes. Every fire opened its own root cause analysis: eleven separate investigations of one problem, eleven answers to the same question, and a bill for all eleven. Point an agent at a raw alert stream and that is what you buy. Three things have to be true before a cluster is worth an investigation:
Investigation is the expensive step. Everything before it exists to protect it. A team with no agent at all can still use those three gates as a checklist.
5. The agent splits the question, not the work
An investigation runs in phases: gather context, reach a checkpoint where it decides whether to split, run hypotheses in parallel, then record one verdict. The fan-out is by hypothesis, not by workload. Two to four read-only investigators run at once, eight at the very most. Each one tests a different explanation against the same evidence at the same time. The investigators record nothing; the lead writes one verdict, so there is one record to read later instead of several. The skill worth taking home is the question each split is looking for: the query whose result differs depending on which hypothesis is true. Every other query confirms what you already believe. Read-only also means the agent cannot test an idea by changing something. It has to reason, and you have to be able to check the reasoning, which is why the log matters more than the answer.6. Order in time is not proof of cause
Three ways a confident timeline turns out to prove nothing:
If you cannot draw the path, you have a coincidence, not a cause. The obvious answer is usually the trigger, and the trigger is often the thing that has already stopped.
7. The root cause is the resource that changed
A causal graph has five kinds of node, and only one of them is the answer.
Divergence is a claim about time, so it is settled by dating each candidate: creation timestamp, revision history, last-applied configuration. Never by which resource currently reads the most abnormal. The resource showing the worst symptoms is usually a victim, and repairing a victim is a workaround, so a definition built around “what would I edit to clear the alert” names the wrong resource almost every time.
Contributing factor is the honest label for everything you suspect but cannot date. It is not a weaker root cause. It is a different kind of claim.
8. A system that scores itself proves nothing
The interesting part of an autonomous system is the list of things it refuses to claim.
After a remediation is applied, CloudThinker schedules one re-check roughly thirty minutes later and records the outcome as verified, unverified or failed. Beyond that window the honest answer is that the system does not know, so no number is printed for it.
A remediation also passes a policy gate whose default is approval, and turning autonomy off still leaves detection running: the system correlates and files the incident, it just will not investigate without you. Yesterday you labelled every claim verified or assumed. Today the system holds itself to the same rule.
Keynote · 25 minutes
The Integration Problem Was a Context Problem. Why writing code for an agent to call beats packing tool schemas into its context, and how the team built 100+ connections to cloud and observability platforms in a very short time. It picks up where Learn ends: the agent can investigate because it can reach the data, and this is how that layer got built.Practice · 30 minutes
The task: one live incident on a Kubernetes cluster CloudThinker runs. One team, one read-only agent, one report. Thirty minutes, no break.Hotel Search Degradation After Traffic RecoveryThat is the same title the on-call would get. The dashboards will not agree with the users, so start from what the customer lost.
The permissions are real. If your team hits a wall, that wall is part of the exercise. Write it down as blocked, the same way you did on Day 01.
The rail is a pace, not a rule. A team that reaches T+18 with one hypothesis has skipped the part that matters.
Connect to the demo environment
1
Sign in and open the demo environment
Sign in at app.cloudthinker.io. In the left sidebar, click Try a demo environment. It is described as “a read-only cloud we run”.
2
Open Connections and pick Kubernetes
The Connections panel for the demo environment lists the connections you can try with demo data. Click Kubernetes.
3
Click Use demo
A banner at the top of the dialog offers the read-only demo. Click Use demo. Ignore the forms below it. They are for connecting your own cluster, and today you do not need them.Success state: Kubernetes no longer appears under Not connected. Open a new chat and ask about the cluster.
What to ask the agent
Most teams start by asking what is wrong. Push past the first answer instead. Starting points:Stuck?
- The agent reports a healthy system. Ask it what the users are seeing rather than what the dashboards say. Healthy dashboards are part of the exercise.
- The agent gives you one confident cause immediately. Ask for the rival explanation, then for the query that separates the two.
- The agent says it cannot read something. Good. Write it down as blocked. A blocked check is a result.
- You run out of time. Submit what you have with the gap named. That is a complete report.
Your output is one report
PDF, doc or markdown. There is no template. Five things, not eight, because you only have thirty minutes.
A report that says “insufficient evidence” and shows the log is a complete report. A confident answer with no path is worth less. No remediation proposal is required; thirty minutes is not enough for one, and a team that produces one anyway earns credit.
One file per team, submitted before Share starts. Redact anything that identifies a real system first.
Share · 20 minutes
Volunteers present. Every team that presents gets a prize. No scoring, no ranking, no vote.
Then the room compares: same cluster, same read-only access, different answers. That comparison is the point, and it is why the log and the evidence fields matter more than the verdict.