> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usekestrel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Response Quickstart

> Set up AI-powered incident detection and response

Kestrel monitors your Kubernetes clusters and cloud infrastructure 24/7, detecting incidents as they happen. When something goes wrong, AI agents automatically investigate the root cause, generate production-ready YAML or Terraform fixes, identify the causal PR, and create postmortems — with optional auto-remediation.

## What You Get

* **24/7 Monitoring** — continuous detection across K8s and cloud resources
* **Automatic Root Cause Analysis** — AI traces the full causal chain, not just symptoms
* **Production-Ready Fixes** — YAML manifests and Terraform changes you can apply directly or merge as PRs
* **Causal PR Detection** — identifies the code change that introduced the issue
* **Postmortem Generation** — structured incident summaries for your team
* **Auto-Remediation** — optionally apply fixes automatically (disabled by default)

## Setup

**1. Connect a Kubernetes cluster or cloud account**

Kestrel needs visibility into your infrastructure to detect incidents.

**For Kubernetes:** Install the Kestrel Operator via Helm. See the [Kubernetes integration guide](https://docs.usekestrel.ai/integrations/kubernetes.md) for full instructions.

```bash theme={null}
helm install kestrel-operator \
  oci://ghcr.io/kestrelai/charts/kestrel-operator \
  --version 1.0.0 \
  --namespace kestrel-ai --create-namespace \
  -f kestrel-ai-operator-values.yaml
```

**For AWS:** Connect your account with a read-only IAM role. See the [AWS integration guide](https://docs.usekestrel.ai/integrations/aws.md).

**For OCI:** Connect your Oracle Cloud tenancy. See the [OCI integration guide](https://docs.usekestrel.ai/integrations/oci.md).

> [!TIP]
>
> You can connect multiple clusters and cloud accounts. Kestrel monitors all of them from a single dashboard.

**2. (Optional) Connect observability tools**

Adding observability context improves root cause analysis by giving Kestrel access to metrics, traces, and monitor alerts.

* **[Datadog](https://docs.usekestrel.ai/integrations/datadog.md)** — pull metrics, monitors, and APM traces into incident investigations
* **[OpenTelemetry](https://docs.usekestrel.ai/integrations/opentelemetry.md)** — ingest traces and metrics from your OTel pipeline

> [!NOTE]
>
> Observability integrations are optional. Kestrel performs RCA using Kubernetes and cloud signals alone, but metrics context produces more precise root causes.

**3. Connect notification channels**

Route incident alerts to the tools your team already uses.

* **[Slack](https://docs.usekestrel.ai/integrations/slack.md)** — receive incident notifications in a channel, ask follow-up questions in threads, and get @mentioned as a namespace owner
* **[PagerDuty](https://docs.usekestrel.ai/integrations/pagerduty.md)** — trigger on-call alerts with full RCA context and automatic resolution when the incident clears

**4. Connect code repositories**

Linking your repositories enables causal PR detection and GitOps-based remediation.

* **[GitHub](https://docs.usekestrel.ai/integrations/github.md)** — detect which PR introduced the issue; create fix PRs automatically
* **[GitLab](https://docs.usekestrel.ai/integrations/gitlab.md)** — same capabilities via merge requests

When Kestrel generates a fix, it can open a PR against your repository so the change goes through your existing review and deployment pipeline.

**5. Add knowledge sources**

Knowledge sources give Kestrel historical and organizational context to produce better root cause analysis and more relevant fixes.

* **[Confluence](https://docs.usekestrel.ai/integrations/confluence.md)** — runbooks, architecture docs, past incident writeups
* **[Jira](https://docs.usekestrel.ai/integrations/jira.md)** — related tickets and known issues
* **[Glean](https://docs.usekestrel.ai/integrations/glean.md)** — enterprise knowledge search across all your tools
* **[Slack history](https://docs.usekestrel.ai/integrations/slack.md)** — past conversations and tribal knowledge

See [Knowledge Sources](https://docs.usekestrel.ai/integrations/knowledge-sources.md) for setup details.

## Your First Incident

Once your integrations are connected, Kestrel begins monitoring immediately. Here's what happens when an incident is detected:

1. **Detection** — Kestrel identifies an anomaly (pod crash, deployment failure, cloud resource issue, etc.)
2. **Investigation** — AI agents gather context from your cluster, cloud APIs, metrics, logs, and knowledge sources
3. **Root Cause Analysis** — a structured RCA is generated with the full causal chain
4. **Fix Generation** — production-ready YAML or Terraform changes are proposed
5. **Causal PR** — if a recent code change caused the issue, the specific PR is identified
6. **Notification** — alerts are sent to Slack, PagerDuty, or both — with the RCA, fix, and causal PR attached
7. **Remediation** — apply the fix from the dashboard, merge the generated PR, or let auto-remediation handle it

> [!WARNING]
>
> Auto-remediation is disabled by default. Enable it per-cluster from **Settings → Incident Response** only after you've reviewed and trusted Kestrel's fixes in your environment.

## Build Custom Incident Response Workflows

For more complex incident response scenarios — escalation chains, multi-step remediation, cross-team coordination — use [Workflows](https://docs.usekestrel.ai/quickstart/workflows.md) to build custom automation that triggers on Kestrel incidents.

**Example:** When a critical incident is detected in production, run RCA, post to Slack, page the on-call engineer via PagerDuty, create a Jira ticket, and if unacknowledged after 15 minutes, escalate to the engineering manager.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.