Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Estimated time: 10 minutes
Connect your incident platform and create a response plan. When incidents arrive, your agent automatically investigates and generates detailed execution plans.
What you accomplish
By the end of this step, your agent:
- Receives incidents from Azure Monitor, PagerDuty, or ServiceNow
- Automatically investigates matching incidents
- Generates AI execution plans from your instructions
- Collects evidence and provides recommendations
Prerequisites
| Requirement | Details |
|---|---|
| Agent created | Complete Step 1: Create your agent first. |
| Incident platform | Azure Monitor (default), PagerDuty, or ServiceNow. |
Tip
While not required, completing Step 2: Add knowledge and Step 3: Connect source code significantly enhances incident response. Your agent references your runbooks and correlates problems to specific code changes, turning generic investigations into team-specific root cause analysis.
Connect your incident platform
Choose and configure the incident platform your team uses.
Azure Monitor (default)
Azure Monitor connects automatically when you create your agent. No additional configuration is needed.
PagerDuty or ServiceNow
To connect PagerDuty or ServiceNow as your incident platform:
- Select Settings in the left sidebar.
- Select Incident platform.
- Choose your platform from the dropdown:
- PagerDuty: Enter your REST API access key.
- ServiceNow: Enter your instance URL and credentials.
- Select Save.
Your agent now receives incidents from your platform.
Create a response plan
Create response plans from the Subagent builder canvas. You can see which triggers route to which subagents.
- Select Builder in the left sidebar.
- Select Subagent builder.
- Find the subagent you want to handle incidents and select the + button on its left side.
- Select Add incident trigger.
- Configure the trigger: set a name, select severity levels (for example, P1 and P2), choose the impacted service, and optionally add a title keyword filter.
- Choose the autonomy level (Review is recommended to start).
- Preview matching incidents, and then select Create.
Your trigger appears as a node connected to the subagent on the canvas.
Tip
When you first connect an incident platform, the system might automatically create a default quickstart response plan. If you set up your own triggers through the Subagent builder, delete the default plan from Builder > Incident response plans to avoid conflicts. Two overlapping plans can cause incidents to be handled by the wrong subagent or duplicated.
For the full step-by-step guide with screenshots, see the Set up an incident trigger tutorial.
What happens when an incident arrives
When an incident matches your plan, the agent handles it automatically.
- Retrieves incident details from your platform.
- Searches memory for similar past incidents and relevant documentation.
- Executes the plan by running commands and collecting evidence.
- Summarizes findings with timestamps and recommendations.
Example findings
The following example shows findings from a container app incident:
Summary:
- Container restarted around 01:27Z with memory dropping sharply.
- Current config: 2 Gi memory, 1 CPU, minReplicas=2, maxReplicas=4.
Likely cause: Transient container restart (OOM or deployment).
Recommended actions:
- Increase minReplicas to 3-4 to reduce restart impact.
- Review container health probes.
Your agent provides actionable recommendations based on evidence, not generic advice.