Incident Investigator (Slack)
Install Incident Investigator (Slack) from the Pick Experts step at onboarding. It’s a single incident-response Expert with two activation modes:- Alert-thread mode: The Expert watches one or more long-lived Slack alert channels that receive alerts from your incident-management platform (PagerDuty, Opsgenie, Datadog, incident.io, and similar) as well as free-form incident reports. Each fresh top-level message launches a per-incident session that triages, investigates your logs and metrics, posts a root-cause analysis in-thread, and subscribes to the thread for follow-ups. When the platform posts the resolution update, the session posts a post-resolution summary and suggests a formal post-mortem write-up.
- Stationed-channel mode: A human launches the Expert with a link to an ad-hoc incident channel — or a trigger auto-launches it when a channel matching your incident-channel naming pattern is created. One session watches the whole channel, handles every incident-like top-level message and engaged-thread follow-up, runs the same post-resolution summary on resolution, and stays alive until a human posts
stop.
- Best for: On-call teams who want triage, log/metric investigation, and root-cause analysis started the moment an alert fires — with findings posted where responders already are.
- How to use: Connect the Slack integration and point the Expert’s triggers at your alert channels (and optionally at incident-channel creation). For stationed-channel mode, start a session with the Expert and paste the incident channel link. The Expert needs skills for querying your logs and metrics backends — set these up when installing it.
See Also
- Slack configuration — connect the Slack app and invite the bot to private incident channels.
- PR Author — the worker that opens fix PRs once a human approves.
- Understanding Automation — triggers, subscriptions, and the events log behind this Expert.