The sources investigations draw on, and how to set each one up.
Investigations are only as good as the context they can reach. Each source you connect gives investigations another angle on what’s happening, and findings grounded in several sources at once are far more reliable than guesses from one. The more independent evidence an investigation can find, the more conviction it can have in a finding rather than guess. Connect whatever you have; you don’t need everything to get value.All sources are configured from the Investigations settings in your dashboard.
Pattern matching against your history: what this looked like before and how it was fixed.
Slack channels
Human context telemetry can’t give: a mentioned migration, a deploy notification, a config change.
Change events
A timeline of deploys, flag flips, and config changes to line up against when the incident started.
Documentation
Your team’s own knowledge: runbooks for this exact failure, and how your services are meant to work.
Code repositories
The pull request that likely caused the issue, and the ability to trace errors through code.
Telemetry
Hard signal: error spikes, latency changes, log lines, and the dashboards your team trusts.
Connecting Slack channels as a source (and the change events built from them) is available for Slack only. Every other
source works the same whether your incidents run in Slack or Microsoft Teams.
Start with the sources your responders already lean on during incidents. If your team lives in a particular Grafana
dashboard and a Slack deploys channel, connect those first.
One source needs no setup. Every investigation automatically checks whether third-party providers you depend on, like AWS, GitHub, Stripe, or Datadog, were having an outage around the time of your incident. See Third-party dependencies.
