How an investigation works

Between “you ask” and “you get an answer” there’s a definite process, and knowing it helps you read the results. This page walks through one investigation from question to settled case.

You ask, the Investigator opens a case

An investigation starts when you ask — in the console, or by mentioning @Microtica in a Slack thread. Either way the Investigator opens a case: a living document that outlives the run that created it. Ask a follow-up next week and it lands in the same case, with everything already learned still in place.

Evidence gathering

The Investigator works through your connected accounts the way an engineer would: it reads CloudWatch logs and metrics in AWS, pod states and events in Kubernetes, recent commits and diffs in your repositories, edge configuration in Cloudflare — whatever the trail calls for among the integrations you’ve connected. It cross-references as it goes; a failing health check in ECS often ends at a commit in Git.

Each run is scoped. An investigation triggered from a Slack alert channel is bound to that channel’s AWS account, and the Investigator can’t cross into another account on its own — if the trail points elsewhere, it reports that and waits for you to approve widening. See Security & access.

The case document

The case states its conclusion the way a careful colleague would:

• Working hypothesis — the current best explanation, with a posture (critical, degraded, watch, or nominal) and a plain-language confidence. A hypothesis is allowed to change as evidence lands.
• Findings — each individually marked Confirmed, Likely, or Low, so you can see exactly which parts rest on hard evidence. Dead ends stay visible as Ruled out, and open threads as Loose end — the Investigator tells you what it hasn’t nailed down.
• Next moves — concrete recommended actions. The Investigator recommends; you decide and act.

Below the current case sits the journal: one chapter per run, newest first, each with its verdict and full report. A three-week incident reads as a story, not a scrollback.

When it needs you

Sometimes only you know the answer — “is this traffic expected?” — and sometimes a command needs your approval. The run pauses and the case moves to Needs you in the inbox, showing a Waiting on you card with the question and either answer buttons or a text field. For a case that started in Slack, your answer is posted to the thread as you, so the team sees the decision where the conversation lives. You can also press Stop on any running investigation.

How a case settles

A case moves from open through investigating to root caused or resolved. When no run is active and nothing is waiting on you, it rests in Settled — until a thread reply or a Deepen wakes it into a new chapter of the same journal.

Next: Security & access