Connect your data

The sources investigations draw on, and how to set each one up.

Investigations are only as good as the context they can reach. Each source you connect gives investigations another angle on what’s happening, and findings grounded in several sources at once are far more reliable than guesses from one. The more independent evidence an investigation can find, the more conviction it can have in a finding rather than guess. Connect whatever you have; you don’t need everything to get value.

All sources are configured from the Investigations settings in your dashboard.

Sources

Past incidents

Find similar incidents and the fixes that worked before.

Slack channels

Real-time context: deploys, config changes, and team discussion.

Change events

Deploys, feature flags, and config changes, extracted from your channels and correlated with incidents.

Documentation

Search your runbooks and reference docs from Confluence, Notion, GitHub, and GitLab.

Code repositories

Link relevant pull requests and read your code, safely sandboxed.

Telemetry

Logs, metrics, traces, and dashboards from your observability tools.

How investigations use each source

Source	What it adds to an investigation
Past incidents	Pattern matching against your history: what this looked like before and how it was fixed.
Slack channels	Human context telemetry can’t give: a mentioned migration, a deploy notification, a config change.
Change events	A timeline of deploys, flag flips, and config changes to line up against when the incident started.
Documentation	Your team’s own knowledge: runbooks for this exact failure, and how your services are meant to work.
Code repositories	The pull request that likely caused the issue, and the ability to trace errors through code.
Telemetry	Hard signal: error spikes, latency changes, log lines, and the dashboards your team trusts.

Connecting Slack channels as a source (and the change events built from them) is available for Slack only. Every other source works the same whether your incidents run in Slack or Microsoft Teams.

Start with the sources your responders already lean on during incidents. If your team lives in a particular Grafana dashboard and a Slack deploys channel, connect those first.

Always on: third-party dependencies

One source needs no setup. Every investigation automatically checks whether third-party providers you depend on, like AWS, GitHub, Stripe, or Datadog, were having an outage around the time of your incident. See Third-party dependencies.

FAQs

Can we connect our own tools, not just the built-in sources?

Yes. Extensions let you connect your own MCP servers, and write skills that tell investigations how to use them. To reach a private or self-hosted system, run a proxy in your network and attach the data source to it.

Can investigations hand a fix to our own coding agent?

Yes. As well as opening a pull request itself, an investigation can delegate a code change to a coding agent your team already runs, like Cursor or Codex. See Delegating agents.