Investigation and RCA

Follow Anna’s evidence-led investigation from context gathering through a structured root-cause verdict and remediation plan.

Root Cause Analysis (RCA) is the Analyze stage of the Deep Response Engine. Anna gathers context, starts the read-only specialist work that the incident needs, tests competing explanations, and returns a structured verdict.

RCA can start automatically for an eligible Pulse incident when DRE auto-investigates is on. A manually logged Incident waits until you click Investigate.

How an investigation runs

RCA has three phases:

Phase	What happens
Context	Anna reads the Incident, Pulse signals, available topology, and connected operational data.
Analysis	Anna can start parallel, read-only subagents to test hypotheses against logs, metrics, traces, changes, and dependencies.
Resolution	Anna records the supported root cause or another disposition, then organizes evidence and recommended actions.

The specialist set is dynamic. Anna selects the domains required by the evidence instead of running a fixed agent roster for every Incident. A typical investigation uses two to four subagents, with a maximum of eight.

RCA reads connected systems during investigation. A proposed action follows the runbook effect: Allow, Require Approval, or Deny.

Read the result

The investigation view keeps the conclusion and its proof together:

Section	What to look for
Root cause	The confirmed explanation, identification time, and agent-recorded confidence.
How it happened	A causal graph that connects the initiating condition to the visible impact.
Hypotheses	The explanations Anna tested, including confirmed and ruled-out paths.
Evidence	Supporting logs, metrics, traces, changes, alerts, and configuration observations.
Timeline	The ordered investigation steps and important operational events.
Affected services	The services and dependencies involved in the incident.
Remediation	Recommended next actions, including any runbook that needs approval.

Confidence is supporting context, not a guarantee. The interface groups the agent-recorded score as High at 0.8 or above, Medium from 0.5 to below 0.8, and Low below 0.5. Review the linked evidence before you approve a change.

Investigation outcomes

Anna can complete an RCA run with one of these terminal outcomes:

Outcome	Meaning
Root cause identified	The evidence supports a root cause and remediation can proceed.
False alarm	The reported condition was not an incident.
Not found	The available evidence did not support a root cause.
Resolved	Remediation was verified with a person in the loop.
Auto-resolved	The agent verified the remediation with nobody in the loop.

On hold is not terminal. It pauses the investigation when Anna needs information, access, or a decision. The Incident enters Needs your decision until a person supplies what RCA needs to continue. Acknowledged is also not terminal: a responder owns the Incident but analysis has not started.

The Investigation queue groups work by what needs attention: AI is handling, Needs your decision, Not started, Resolved, and Dismissed. Incidents with a Not found result do not remain in the visible queue.

Start or rerun RCA

1. Open an Incident

   Select an Incident from the Investigation queue. Review its source, severity, signals, and existing evidence.

2. Start the investigation

   Click Investigate when the Incident is waiting for manual analysis. Pulse-created Incidents can start automatically when On Duty is enabled and the routing rules qualify them.

3. Review the verdict

   Read the root cause, causal graph, hypotheses, evidence, and remediation before you approve an action or resolve the Incident.

Rerun RCA when new evidence changes the case. The new run does not erase the earlier investigation.

Example investigation

These examples show how an investigation can move from one infrastructure symptom to a correlated root cause.

@alex #report investigate EC2 termination patterns for the past 60 days.
Break down the events by Auto Scaling group, termination reason, instance
type, and availability zone.

An infrastructure investigation begins with the termination pattern.

@alex #report correlate CreateNetworkInterface failures with the EC2
termination events. Test whether scale-down behavior affects ENI cleanup
or subnet capacity.

A second pass tests whether the symptoms share a cause.

@anna #report synthesize the EC2 and EKS findings into one RCA. Include
the supported root cause, evidence, causal sequence, remediation, and
follow-up checks.

Anna combines the supported findings into one reviewable verdict.

Related

Log an Incident

Create an Incident from a human report, then start RCA when you are ready.

Control automatic RCA

Set On Duty behavior and re-investigation sensitivity.

Use runbooks

Review the actions that DRE can suggest, approve, or block.

Reuse lessons

See how agent-written lessons can inform later investigations.