Skip to main content
Warrnagen investigations run in the background and appear on the alert detail page under the Investigation tab. This is separate from the organisation’s AI Triage setting, which controls runbook matches and similar-past-alert suggestions.

​
What it does

Warrnagen reads the alert, then pulls relevant context from:
  • Your codebase (recent changes around the affected service).
  • Logs and metrics from the providers configured on the service.
  • Recent deploys.
  • Past incidents and historically similar alerts.
  • Connected knowledge (runbooks, postmortems).
It works through a planning phase, runs a handful of focused sub-agents in parallel, then consolidates everything into a single summary.

​
What you see

The Investigation tab moves through clear states:
  • Pending - the investigation is queued.
  • Running - a progress bar shows the current phase and which sub-agents are active.
  • Completed - a summary card with the suspected root cause, severity, and confidence, followed by:
    • Findings - individual observations with their own severity and confidence.
    • Recommended actions - what to do next, ranked by urgency.
    • Affected components - which services, hosts, or modules are implicated.
    • Suggested runbooks - matched from your Knowledge and any connected Confluence space.
    • Code fix - if a likely fix is in your codebase, a draft PR link.
  • Failed - shown with a Retry button.

​
Relationship to AI Triage

Turning AI Triage off does not disable Warrnagen investigations or alert chat. It stops the two automatic enrichment steps covered by that policy: runbook matching and similar-past-alert suggestions.

​
Asking follow-ups

Below the investigation summary, Ask Warrn opens a chat panel scoped to this alert. You can ask “what changed in the last hour?”, “show me the relevant log lines”, “draft a Slack update”, and Warrnagen answers with the same context it used for the investigation.