> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident management & troubleshooting

> Detect, group, investigate, remediate, and learn from production incidents — with the evidence behind every conclusion.

The Incident management & troubleshooting module owns the path from an incoming alert to an understood, remediated production
incident. This page explains what the module is accountable for, the workflow inside it, what you
need connected before it can work, and what you see once it starts running.

## What this module owns

An alert fires. Somebody acknowledges it, opens three dashboards, checks what deployed recently,
asks in Slack whether anyone else is seeing it, and eventually forms a theory. Most of that is
retrieval, and most of it is repeated on the next alert.

Incident management & troubleshooting takes that work. It groups related alerts into one incident, dispatches domain
specialists to gather evidence in parallel, produces a root-cause conclusion with the evidence
attached, and proposes a remediation for a human to approve. What you own is the decision; what the
module owns is everything leading up to it.

Good looks like: one incident per real problem rather than one per alert, a conclusion you can
audit, and a remediation you approve rather than research.

## The workflow inside it

This module contains **1 workflow**.

### Production Alert Investigation

Correlates production alerts, runs a multi-agent root-cause analysis, and governs remediation.

| Step                       | What happens                                                                                                                               |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **1 · Source**             | Which alerts start this workflow, and from where.                                                                                          |
| **2 · Dedupe & correlate** | Collapse repeats and related alerts into a single incident.                                                                                |
| **3 · Investigation**      | Domain specialists gather evidence in parallel — the observability, Kubernetes, and cloud investigators each contribute what they can see. |
| **4 · Remediation**        | Propose the fix and route it for approval before anything is applied.                                                                      |

Each step delivers its task to the agents bound to it, so you can see exactly which agent handled
which stage of an investigation.

<Note>
  A step with no agents bound still carries its task — it just has nothing to execute it. Bind an
  agent to every step you expect to run.
</Note>

## What it needs connected

| Requirement          | Why                                                                                                 | Where to set it up                                                         |
| -------------------- | --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| An alert source      | Something has to start the workflow — an endpoint your monitoring posts to, or a connected provider | [Built-in integrations](/manage-your-agents/build/built-in-integrations)   |
| Observability access | So investigators can read metrics, logs, and traces around the alert                                | [Built-in integrations](/manage-your-agents/build/built-in-integrations)   |
| Investigation agents | The specialists bound to the investigation step                                                     | [Use specialized agents](/manage-your-agents/build/use-specialized-agents) |
| Slack (optional)     | Post the conclusion where the on-call is already looking                                            | [Channels](/manage-your-agents/run/channels)                               |

## Enabling it

<Steps>
  <Step title="Open Modules → Overview">
    Incident management & troubleshooting appears in the AI SRE family with the workflow it contains.
  </Step>

  <Step title="Turn it on">
    Enabling the module adds Incident management & troubleshooting to your sidebar.
  </Step>

  <Step title="Connect a source and bind agents">
    Point an alert source at the workflow and bind an agent to each step you expect to run.
  </Step>
</Steps>

## What you see when it runs

The module's sidebar entry lists every incident it has produced. Each one carries:

* **The alert that started it**, and any alerts folded into it during correlation.
* **The investigation** — which specialists ran, what each found, and the runs behind them.
* **The conclusion**, with the evidence that supports it.
* **The proposed remediation**, and whether it is waiting on a human.

Because every step is a run, an incident is auditable end to end: you can open any stage and read
exactly what the agent saw and did.

## Next steps

<CardGroup cols={2}>
  <Card title="Orchestration" href="/manage-your-agents/run/orchestration">
    How workflow steps deliver tasks to agents.
  </Card>

  <Card title="Runs & evidence" href="/manage-your-agents/run/runs-evidence">
    How to read the evidence trail behind a conclusion.
  </Card>

  <Card title="Approvals" href="/security-and-governance/controls/approvals">
    How remediation waits for a human decision.
  </Card>

  <Card title="Alert Intelligence" href="/modules-and-workflows/sre/alert-hygiene">
    Fix the noise upstream so fewer alerts become incidents.
  </Card>
</CardGroup>


## Related topics

- [Modules & workflows](/modules-and-workflows/overview.md)
- [Channels](/manage-your-agents/run/channels.md)
- [Knowledge graph](/manage-your-agents/optimize/knowledge-graph.md)
- [Alert Intelligence](/modules-and-workflows/sre/alert-hygiene.md)
- [Proactive reliability optimization](/modules-and-workflows/sre/reliability-optimization.md)