> ## Documentation Index
> Fetch the complete documentation index at: https://docs.warrn.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Warrnagen investigation

> What the AI does to an alert before you even look at it.

When [AI Triage](/components/teams/alert-intelligence) is on for a service's team and the service itself, Warrnagen automatically investigates every new alert. The investigation runs in the background and shows up on the alert detail page under the **Investigation** tab.

## What it does

Warrnagen reads the alert, then pulls relevant context from:

* Your codebase (recent changes around the affected service).
* Logs and metrics from the providers configured on the service.
* Recent deploys.
* Past incidents and historically similar alerts.
* Connected knowledge (runbooks, postmortems).

It works through a planning phase, runs a handful of focused sub-agents in parallel, then consolidates everything into a single summary.

## What you see

The Investigation tab moves through clear states:

* **Pending** - the investigation is queued.
* **Running** - a progress bar shows the current phase and which sub-agents are active.
* **Completed** - a summary card with the suspected root cause, severity, and confidence, followed by:
  * **Findings** - individual observations with their own severity and confidence.
  * **Recommended actions** - what to do next, ranked by urgency.
  * **Affected components** - which services, hosts, or modules are implicated.
  * **Suggested runbooks** - matched from your Knowledge and any connected [Confluence](/components/services/integrations#confluence-for-runbook-search) space.
  * **Code fix** - if a likely fix is in your codebase, a draft PR link.
* **Failed** - shown with a **Retry** button.

## When it's off

If AI Triage is off for the team or the service, the Investigation tab shows a disabled state explaining where to turn it on. The rest of the alert page works normally; you just don't get the AI summary or runbook suggestions.

## Asking follow-ups

Below the investigation summary, **Ask Warrn** opens a chat panel scoped to this alert. You can ask "what changed in the last hour?", "show me the relevant log lines", "draft a Slack update", and Warrnagen answers with the same context it used for the investigation.