Skip to main content
Investigations are only as good as the context they can reach. Each source you connect gives investigations another angle on what’s happening — and findings grounded in several sources at once are far more reliable than guesses from one. Connect whatever you have; you don’t need everything to get value. All sources are configured from the Investigations settings in your dashboard.

​
Sources

Past incidents

Find similar incidents and the fixes that worked before.

Slack channels

Real-time context: deploys, config changes, and team discussion.

Change events

Deploys, feature flags, and config changes, extracted from your channels and correlated with incidents.

Documentation

Search your runbooks and reference docs from Confluence, Notion, GitHub, and GitLab.

Code repositories

Link relevant pull requests and read your code, safely sandboxed.

Telemetry

Logs, metrics, traces, and dashboards from your observability tools.

​
How investigations use each source

SourceWhat it adds to an investigation
Past incidentsPattern matching against your history — what this looked like before and how it was fixed.
Slack channelsHuman context telemetry can’t give: a mentioned migration, a deploy notification, a config change.
Change eventsA timeline of deploys, flag flips, and config changes to line up against when the incident started.
DocumentationYour team’s own knowledge — runbooks for this exact failure, and how your services are meant to work.
Code repositoriesThe pull request that likely caused the issue, and the ability to trace errors through code.
TelemetryHard signal: error spikes, latency changes, log lines, and the dashboards your team trusts.
Start with the sources your responders already lean on during incidents. If your team lives in a particular Grafana dashboard and a Slack deploys channel, connect those first.

​
Always on: third-party dependencies

One source needs no setup. Every investigation automatically checks whether third-party providers you depend on — like AWS, GitHub, Stripe, or Datadog — were having an outage around the time of your incident. See Third-party dependencies.