Skip to main content
Incidents rarely happen in isolation. The same failure modes recur, and the fastest way through an incident is often to remember how you got through the last one like it. Connecting your incident history lets investigations do exactly that — recognizing that a similar latency spike happened three months ago and was resolved by rolling back a specific deploy, and surfacing those proven steps instead of starting from scratch.

​
How investigations use this

An investigation matches the incident you’re responding to against your entire history — not by keyword, but by what actually happened. It looks at the symptoms, the systems involved, and the shape of the failure to find genuinely similar incidents, then draws out what mattered from each: the root cause that was eventually found, and the steps that resolved it. Those learnings feed directly into the investigation’s hypothesis and its recommended next steps, so a finding can be grounded in something your team has already lived through. The knowledge is already there — captured in incidents you’ve run and resolved — and an investigation can recall all of it at once.
A resemblance to a past incident is a strong starting point, but on its own it’s a pattern to test, not a conclusion. An investigation builds conviction in the match as your code, telemetry, and the incident’s own context corroborate it.

​
Setup

Enable past incidents from the Investigations settings in your dashboard. Investigations use the incidents already in your incident.io account, so there’s nothing external to connect.

How investigations work

How similar incidents become evidence in a finding.