> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Alert Investigation Modes

ResolveAI participates in your team's on-call rotation, triaging and investigating alerts so engineers can start their shift with answers instead of pages.

When you enable auto-investigation in the **Alerts** configuration on [Teams & Knowledge](/team-knowledge), Resolve investigates alerts as they come in.

**Investigation modes** are how you tell Resolve how much effort to spend on each alert.

***

## Matching Effort to the Alert

Every alert is different, and the right amount of effort depends on the context. Sometimes that's a full root-cause analysis, sometimes just routing to the right team, sometimes a low-QPS blip you can safely ignore.

You can choose between three automation modes: **Triage**, **Adaptive**, or **Investigation**. Each produces a collaborative report in the Resolve UI, and Resolve posts the findings to the team's Slack or MS Teams alert channels so you can discuss them there too. Other investigation types like chat-driven and incident investigations follow their own flows and are not affected by the mode you pick here.

<Info>
  **Not sure where to start?** Use **Adaptive**. It gives you a fast triage on simple alerts and a deep investigation when it matters.
</Info>

***

## How Each Mode Works

### Triage

* Resolve follows the alert runbooks configured in Resolve through knowledge, or builds one on the fly to determine impact when none are attached. It summarizes the findings and pauses.
* Anyone can manually escalate to a deep Investigation at any time from Slack, MS Teams, or the Resolve UI.
* **Use this for**: High-volume, low- and medium-severity alerts where you just need a quick read.

### Adaptive

* Adaptive is an intelligent configuration mode. It weighs each incoming alert's impact, runbook findings, and the team's past engagement with similar alerts to decide how much effort to put into the investigation.
* You can shape Adaptive's decisions by writing runbooks that capture your team's criteria for when to escalate and when to stop.
* **Use this for**: When you want Resolve on every alert and want it to decide how deep to go.

### Investigation

* Resolve runs a thorough deep investigation where a team of agents explore multiple working theories in parallel. It can also propose [mitigation actions](/mitigation-actions) to address what it finds.
* Alerts configured for Triage or Adaptive can be escalated to a deep Investigation at any time.
* **Use this for**: Critical or P0 alerts and complex migrations where you want a deep, thorough root-cause analysis.

***

## Configuring Modes

1. Configure an alert filter in your ResolveAI Team.
2. Set the mode for each alert filter in your team's Alerts configuration on the [Teams & Knowledge](/team-knowledge) page. Pick from **Triage**, **Adaptive**, or **Investigation**.
3. **Shape Adaptive's escalation behavior**: Adaptive uses runbook guidance to decide whether to stop or escalate. Provide that guidance by attaching runbooks to specific alerts or adding runbook guidance to your team's docs. See the [Knowledge Setup Guide](/knowledge-setup-guide) for more.

***

## FAQ

<Accordion title="Which mode should I use when?">
  Pick based on how much effort each alert deserves:

  * (Recommended) **Adaptive** for most alerts. Resolve weighs each alert's impact, runbook findings, and the team's past engagement with similar alerts to decide how much effort it deserves, making the most efficient use of your subscription. For example, it runs Triage first, then decides whether to escalate to a deep Investigation based on those signals (stopping when similar alerts have routinely gone stale or been ignored).
  * **Triage** for high-volume, low- or medium-severity alerts where you only want a quick read.
  * **Investigation** for alerts that always warrant a deep and thorough root-cause analysis, like P0s, incidents and issues during complex releases and migrations.
</Accordion>

<Accordion title="How does the effort level impact my Resolve subscription?">
  Each mode does a different amount of work. To learn more about how Triage, Adaptive, and Investigation modes impact your subscription, reach out to [help@resolve.ai](mailto:help@resolve.ai).
</Accordion>

<Accordion title="Why did my investigation stop at Triage?">
  This happens with Triage and Adaptive modes:

  * **Triage** always stops after it has executed the runbook. To go deeper, click **Continue Investigation** on the results of the Triage.
  * **Adaptive** stops based on the runbook and the team's past engagement with similar alerts, typically for no-ops, known transient issues, or alerts that have routinely been ignored. You can still escalate manually by clicking **Continue Investigation**.
</Accordion>

<Accordion title="Can I manually escalate a Triage to a deep Investigation?">
  **Yes.** From the Triage result in Slack, MS Teams, or the Resolve UI, click **Continue Investigation**. This works regardless of the alert's configured mode. If you want more detail without committing to a deep investigation, you can also ask follow-up questions on the Triage result without triggering one.

  Asking Resolve to "go deeper" in the alert thread continues the conversation as a chat. It does not start a deep Investigation. Use the **Continue Investigation** button to escalate.
</Accordion>

<Accordion title="Does Triage determine customer impact?">
  Triage attempts to determine customer impact and blast radius as part of its analysis. It works best when a runbook is attached to the alert with guidance on how to assess impact, for example which SLOs, critical user journeys, or dashboards indicate customer-facing degradation. Without an attached runbook, Resolve performs an alert analysis and makes a quick attempt to determine impact.

  To get reliable impact assessments, create a runbook tied to the alert rule or name that spells out your team's impact criteria. In Adaptive mode, Resolve automatically escalates to a deep Investigation when the Triage indicates it is necessary. See the [Knowledge Setup Guide](/knowledge-setup-guide) for more.
</Accordion>

<Accordion title="How do I shape Adaptive's decision to stay at Triage or escalate to a deep Investigation?">
  * Create a runbook that's attached to an alert, or add the guidance to your team's docs.
  * Add your team's decision criteria in the runbook. To direct Adaptive's action, use keywords like deep investigation, RCA, or /rca.
  * Adaptive uses the runbook along with the team's past engagement on similar alerts to decide what to do.
  * To always run a thorough analysis with a team of agents, set the alert filter's configuration to Investigation.
</Accordion>

<Accordion title="What kinds of &#x22;past engagement&#x22; does Adaptive account for?">
  Adaptive looks at how the team has historically responded to similar alerts:

  * Viewing the report in the Resolve UI
  * Reacting, replying in-thread, or @-mentioning Resolve on the alert in Slack/MS Teams
  * Clicking buttons on the alert (e.g. Continue Investigation)
  * Asking follow-up questions

  Depending on those signals, Resolve may skip Triage for alerts that appear consistently low-value, or it may run Triage and then decide not to escalate to a deep investigation.

  For example, if a disk-space warning has been silenced in your paging tool, fires every night during backups, and self-resolves within minutes, Adaptive may learn that the alert does not need deeper investigation unless something materially changes.

  You can always start an investigation by @-mentioning Resolve on the alert in Slack or MS Teams, or by re-enabling the alert from the Team Knowledge page.
</Accordion>

<Accordion title="Are auto-investigations rate limited?">
  Yes. Triage and deep Investigations draw from two independent per-organization limits. See [Limits](/limits) for more details.
</Accordion>