> ## Documentation Index > Fetch the complete documentation index at: https://docs.niro.cx/llms.txt > Use this file to discover all available pages before exploring further. # AI Incident Investigator > Get AI-powered root cause analysis for incidents with one click. ## Overview When an incident fires, click **Investigate** to get a root-cause analysis with concrete remediation steps — generated from live evidence collected directly from your cluster. The investigator is **advisory only** — it never mutates your cluster. It reads logs, events, and state to surface what likely went wrong and what to do about it. ## What the investigator returns A concise diagnosis of what likely caused the incident. High / medium / low — how certain the model is about the analysis. Concrete remediation steps (e.g. "increase memory limit from 128Mi to 512Mi"). Additional steps to prevent recurrence (e.g. "add a liveness probe"). ## Evidence gathered The investigator collects evidence at the time of the investigation: * Affected pod's current phase, restart count, and conditions * Node status and resource usage * Recent Kubernetes Warning events for the affected workload * Current container logs (recent output) * **Previous container logs** — the logs from before the last crash Previous logs are often the most valuable signal — they capture exactly what the container output before it exited. * The manifests that were applied (for Niro-managed deployments) * Recent apply history and status ## Running an investigation ### Manual Go to **Alerts** → click the incident you want to investigate. Click the **Investigate** button in the incident detail panel. The investigation completes in 10–30 seconds. Results are stored — you can re-run at any time to refresh with current evidence. ### Automatic Niro can trigger investigations automatically when incidents change state. Configure in **Settings** → **Auto-investigation**: | Mode | When investigation runs | | ---------- | ------------------------- | | `off` | Never run automatically | | `firing` | When an incident opens | | `resolved` | When an incident resolves | | `both` | On both open and close | `firing` mode is the most useful — you get root-cause analysis the moment something breaks, before you've opened the dashboard. Auto-investigations are best-effort. If the AI provider is unavailable, the auto-investigation is skipped (not retried). Manual investigation is always available. ## Availability Available on Pro and above. The **Investigate** button is visible on Free but disabled with an upgrade prompt. ## Limitations The analysis is probabilistic, not authoritative. **Low-confidence** findings should be treated as suggestions. Always verify before acting on a suggested fix. * If logs have been rotated or the pod deleted before investigation, evidence may be incomplete * Long log tails are truncated to fit the model's context window — most recent logs are always prioritized * Auto-investigations are best-effort: failures are logged but never affect the incident itself ## Related Incident detection, lifecycle, and notification channels. View live logs directly in the dashboard. AI investigation availability by plan. Trigger investigations automatically when incidents fire.