> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mitigation Actions

Mitigation Actions allow ResolveAI to propose remediation steps during incident investigations — such as silencing a noisy alert or reverting a suspect commit — for you to review and approve before anything is executed.

<Info>
  **Human-in-the-loop**: ResolveAI only *proposes* actions. Every action requires explicit human approval before execution. Resolve never has direct access to execute write APIs on your monitoring platforms.
</Info>

## Supported Action Types

### Alert Silencing/Snoozing

Temporarily mute noisy alerts.

* **Platforms**: [Grafana](/grafana), [Kloudfuse](/kloudfuse), [Datadog](/datadog), [AlertManager](/alertmanager-webhooks), [Sumologic](/sumologic)
* **Risk level**: Low — silences can be revoked at any time, which immediately deletes them from the monitoring platform

***

## Security and Safety

Mitigation Actions are designed with multiple safety layers to ensure you stay in full control.

**The model never executes write operations directly.** During an investigation, Resolve evaluates whether a mitigation is warranted and, if so, creates a *proposal*. The proposal is then presented to your team for review. Only after a human explicitly clicks "Approve" does the execution engine carry out the action using your integration credentials.

This is the same approach used for [Git code remediation](/git), where Resolve proposes PRs that require explicit approval before creation.

**Key safeguards:**

* **Explicit approval required** — Every proposal must be approved by a human via the Resolve UI or Slack before any action is taken.
* **No direct API access** — The AI model that generates proposals is completely separated from the execution engine that interacts with your monitoring platforms. The model cannot call write APIs.
* **Encrypted credentials** — Integration write credentials are stored encrypted and only used by the execution engine after human approval.
* **Full audit trail** — Every action is recorded: who proposed it, who approved or rejected it, when, and what was affected. View the complete history in the [Activity Dashboard](#activity-dashboard).
* **Revocable** — Approved alert silences can be revoked at any time, which deletes them from the monitoring platform immediately.
* **Auto-expiration** — Proposals that are not acted upon automatically expire based on the proposed silence duration.
* **Scoped permissions** — Write permissions are scoped to specific operations (e.g., silence management only) and do not grant broader access.

***

## Prerequisites

### Integration Permissions

If your integrations currently use read-only tokens (the default for investigation), you will need to upgrade them with write permissions to enable executing Mitigation Actions. Read-only tokens will continue to work for investigation and mitigation proposals — only mitigation execution requires write access.

| Platform         | What to Update          | Required Permissions for Mitigation                                                                                              |
| ---------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Grafana**      | Service account token   | Add `alert.provisioning:write` RBAC permission (Grafana v11+), or use `Admin` role (older versions). [Setup details →](/grafana) |
| **Kloudfuse**    | Integration credentials | Credentials must have write access to Kloudfuse's embedded Grafana Alertmanager silences API. [Setup details →](/kloudfuse)      |
| **Datadog**      | Application Key scopes  | Add `monitors_downtime` scope. [Setup details →](/datadog)                                                                       |
| **AlertManager** | API token               | Token must have write access to the `/api/v2/silences` endpoint. [Setup details →](/alertmanager-webhooks)                       |
| **Sumo Logic**   | API credentials         | Credentials must have write access to the Muting Schedules API. [Setup details →](/sumologic)                                    |

<Info>
  You only need to update permissions for the platforms where you want to use Mitigation Actions. Other integrations can remain read-only.
</Info>

***

## Configuring Mitigations

Alert silencing is enabled by default for all organizations. An admin can opt out or customize settings on the Mitigations page.

### Organization Defaults

1. Navigate to **Admin > Mitigation Activity** in the Resolve UI
2. In the **Configuration** section, you'll see the available action types:
   * **Alert Silencing** — enable to allow silence proposals during investigations
3. Click **Save**

All action types default to **disabled** — you must explicitly enable each one.

### Team Overrides

You can customize mitigation settings for individual teams to override the organization defaults.

1. In the **Configuration** section, expand **Team Overrides**
2. Select a team from the dropdown
3. Toggle the desired action types for that team
4. Click **Save**

To remove a team override and revert to organization defaults, click **Delete Override** on the team's configuration.

**Configuration hierarchy**: Team override > Organization default > Disabled

***

## How Mitigations Work

### During an Investigation

1. **Alert evaluation** — During an alert investigation, Resolve evaluates whether a mitigation action is warranted given all of the production context
2. **Proposal creation** — If warranted, a proposal appears in the investigation canvas showing:
   * The proposed action (e.g., "Silence alert X for 60 minutes")
   * The rationale for the proposal
   * Any other relevant metadata for the action (e.g., risk-level, duration, revertability, etc)
3. **Notification** — If the investigation is connected to a Slack thread, the proposal is also sent there with interactive Approve/Reject buttons

### Approving or Rejecting

* **In the Resolve UI**: Click **Approve** or **Reject** on the proposal card in the investigation canvas
* **In Slack**: Click the **Approve** or **Reject** button on the proposal message

On approval:

* **For alert silencing**: A silence, downtime, or muting schedule is created in your monitoring platform. A "View in platform" link appears in the proposal.

On rejection:

* The proposal is marked as rejected. No action is taken.

### Revoking an Approved Action

For alert silencing, you can revoke an approved silence at any time:

1. Find the approved proposal in the investigation canvas
2. Click **Revoke**
3. The silence is immediately deleted from the monitoring platform

### Proposal Expiration

Proposals that are not acted upon automatically expire. The expiration window is based on the proposed silence duration — if a silence would no longer be useful by the time it's approved, it expires instead.

***

## Activity Dashboard

The **Admin > Mitigation Activity** page provides an overview of all mitigation proposals across your organization.

### Overview Metrics

* **Total suggested** — Number of proposals created
* **Approved** — Proposals approved by a user
* **Rejected** — Proposals rejected by a user
* **Pending** — Proposals awaiting a decision
* **Revoked** — Approved actions that were subsequently revoked
* **Failed** — Proposals where execution failed after approval
* **Expired** — Proposals that expired before a decision was made
* **Approval rate** — Percentage of proposals that were approved

### Activity Log

A filterable table showing all proposals with:

* Status, action type, user who acted, timestamps
* Link to the original investigation
* Expandable details showing rationale, audit trail, and metadata

**Filters:**

* **Time range**: Last 24 hours, 7 days, 30 days, or 90 days
* **Status**: All, Approved, Rejected, Pending, Revoked, Failed, Expired
* **Capability**: All, or filter by specific action type

***

## Troubleshooting

**No mitigation proposals are appearing during investigations**

* Verify that the desired action types are enabled in **Admin > Mitigation Activity > Configuration**
* Confirm your integration tokens have the required write permissions (see [Prerequisites](#integration-permissions))
* Check that the integration health check is passing in the Integrations page

**Execution fails after approval**

* The integration token likely lacks the required write permissions. Check the permissions table above and update your token.
* Verify the integration health check is still passing

**Proposals are expiring before I can act on them**

* Proposals expire based on the proposed silence duration window. Contact the Resolve team if you need to adjust the default duration.