Skip to main content
When AI Triage is on for a service’s team and the service itself, Warrnagen automatically investigates every new alert. The investigation runs in the background and shows up on the alert detail page under the Investigation tab.

​
What it does

Warrnagen reads the alert, then pulls relevant context from:
  • Your codebase (recent changes around the affected service).
  • Logs and metrics from the providers configured on the service.
  • Recent deploys.
  • Past incidents and historically similar alerts.
  • Connected knowledge (runbooks, postmortems).
It works through a planning phase, runs a handful of focused sub-agents in parallel, then consolidates everything into a single summary.

​
What you see

The Investigation tab moves through clear states:
  • Pending - the investigation is queued.
  • Running - a progress bar shows the current phase and which sub-agents are active.
  • Completed - a summary card with the suspected root cause, severity, and confidence, followed by:
    • Findings - individual observations with their own severity and confidence.
    • Recommended actions - what to do next, ranked by urgency.
    • Affected components - which services, hosts, or modules are implicated.
    • Suggested runbooks - matched from your Knowledge and any connected Confluence space.
    • Code fix - if a likely fix is in your codebase, a draft PR link.
  • Failed - shown with a Retry button.

​
When it’s off

If AI Triage is off for the team or the service, the Investigation tab shows a disabled state explaining where to turn it on. The rest of the alert page works normally; you just don’t get the AI summary or runbook suggestions.

​
Asking follow-ups

Below the investigation summary, Ask Warrn opens a chat panel scoped to this alert. You can ask “what changed in the last hour?”, “show me the relevant log lines”, “draft a Slack update”, and Warrnagen answers with the same context it used for the investigation.