Autonomous incident response
Starting Investigations
Incident response investigations can be started in one of three ways.
Built-in integrations - You can connect a DevOps Agent Space to ticketing systems like ServiceNow using built-in integrations. Once connected, DevOps Agent incident response investigations will be automatically triggered from support tickets, and your DevOps Agent will provide updates of its key findings, root cause analyses, and mitigation plans into the originating ticket.
Webhooks - You can use webhooks to send events to AWS DevOps Agent. For example you can use webhooks to trigger incident response investigations from PagerDuty tickets or Grafana alarms.
Manually - You can manually start incident response investigations from the Incident Response tab of any DevOps Agent Space web app. You can either enter free form text that describes the incident you want your DevOps Agent to investigate, and it will create an investigation plan, collect findings, determine a root cause, and offer to generate a mitigation plan. You can also choose from several pre-configured starting points to quickly begin your Investigation: Latest alarm to investigate your most recent triggered alarm and analyze the underlying metrics and logs to determine the root cause, High CPU usage to investigate high CPU utilization metrics across your compute resources and identify which processes or services are consuming excessive resources, or Error rate spike to investigate the recent increase in application error rates by analyzing metrics, application logs, and identifying the source of failures.
Once you click "Start Investigation" you'll be asked to provide some additional details to help the agent focus its work. The investigation dialog includes the following fields:
Investigation details – Pre-filled with your description. You can edit this to refine the investigation scope.
Investigation starting point – Optionally describe a specific alarm, metric, log snippet, or other starting point for the agent.
Date and time of incident – Auto-filled with the current time in UTC format. Adjust if the incident occurred earlier.
Name your investigation – Auto-generated with a timestamp. You can customize this (maximum 400 characters).
Priority – Select the investigation priority from the dropdown (Medium is the default).
Review and adjust these fields as needed, then click "Start investigating..." to begin. You will then be taken to the investigation details page where you can see your DevOps Agent in action!
Incident triage
The triage phase is the first stage of AWS DevOps Agent's incident response system. When an external event triggers, such as an alarm from Datadog, an incident ticket from ServiceNow, or a problem from Dynatrace, AWS DevOps Agent automatically processes it within seconds to determine whether it should be investigated independently or linked to an existing investigation.
The primary function of the triage stage is incident correlation — identifying related incidents and consolidating them into a single investigation to avoid duplicate work and resource waste. When a new incident arrives, AWS DevOps Agent analyzes it alongside active investigations within a look-back window (typically 20 minutes). Using AI-powered analysis, it examines factors like component similarities, geographic region, and timing patterns to determine relationships between incidents.
AWS DevOps Agent makes one of two decisions:
Linked – Correlates the incident to an existing investigation and sends a steering message to that investigation with context about the new incident.
Proceed – Schedules a new independent investigation for the incident.
Viewing triage decisions
When incidents are linked, the primary investigation receives a steering message containing the linked incident's details and correlation reasoning. On your AWS DevOps Agent Space web app, you'll see a status of LINKED along with correlation reasoning explaining why incidents were linked. The primary investigation displays a list of all linked incidents, allowing you to see the full scope of related issues being investigated together. Your external ticket system (ServiceNow, PagerDuty, etc.) and communication channel (Slack) will receive a notification that the incident was linked along with correlation reasoning.
Unlinking incidents and custom correlation rules
If AWS DevOps Agent incorrectly correlates incidents, you can manually unlink them through the AWS DevOps Agent Space web app. This will reschedule the unlinked incident as an independent investigation. You can also provide custom correlation rules to guide AWS DevOps Agent by creating an AWS DevOps Agent Skill containing your correlation logic and associating it with the triage stage.
Ask for human support
AWS DevOps Agent can connect directly with AWS Support to streamline your incident response process. When you need additional help from AWS Support, from your DevOps Agent Space web app you can create support cases that automatically share investigation context with AWS Support engineers, reducing the time needed to explain your issue.
How it works
When investigating an incident, AWS DevOps Agent builds a comprehensive log of its analysis, including:
Root cause investigation findings
Metrics, logs, and traces analyzed
Code changes and deployment history reviewed
Remediation actions recommended
Timeline of events and system behavior
You can escalate your investigation to AWS Support directly from the AWS DevOps Agent Space web app. When you do, AWS DevOps Agent automatically passes its investigation log to AWS Support, providing the support engineer with full context about your investigation without requiring you to manually gather and explain the details.
Chatting with AWS Support
Once you create a support case, you can communicate with AWS Support in a separate chat window within your AWS DevOps Agent Space web app. This allows you to:
Discuss your issue with AWS Support engineers alongside your AWS DevOps Agent's investigation timeline
View both AWS DevOps Agent's automated analysis and AWS Support's expert guidance in the same interface
Seamlessly share additional information or clarification as needed
The chat experience keeps your AWS DevOps Agent investigation and AWS Support conversation readily accessible, enabling faster collaboration and resolution.
Support plan requirements
Your ability to create and interact with support cases through AWS DevOps Agent depends on your AWS Support plan. Please refer to the Support Plans user guide to learn more about your entitlements.
Note Basic Support customers cannot create technical support cases and therefore cannot escalate AWS DevOps Agent investigations to AWS Support Developer Support customers can create cases through AWS DevOps Agent, but must visit the AWS Support Center
What information is shared with AWS Support
When you create a support case from AWS DevOps Agent Space web app, the following information is automatically shared with AWS Support:
Investigation timeline: Chronological record of AWS DevOps Agent's analysis
Resource information: Affected AWS resources
Observability data: Relevant metrics, logs, and traces from your integrated monitoring tools
Recent changes: Code deployments, infrastructure changes, and configuration updates
Remediation attempts: Actions AWS DevOps Agent recommended
Impact assessment: Scope and severity of the incident
All data shared with AWS Support follows your existing AWS data residency and security configurations. AWS DevOps Agent shares only information related to your specific investigation and respects your organization's data governance policies.
Getting started
To use AWS DevOps Agent's AWS Support integration:
Ensure you have an active AWS Support plan.
Verify your AWS DevOps Agent’s IAM permissions include support case creation (support:CreateCase, support:DescribeCases).
When AWS DevOps Agent is investigating an issue and you need AWS Support assistance, choose Ask for human support from your DevOps Agent Space web app.
Review the investigation summary that will be shared with AWS Support.
Select the appropriate case severity based on your support plan entitlements.
Submit the case - AWS DevOps Agent automatically includes your investigation log.
The chat window opens automatically, allowing you to begin collaborating with AWS Support immediately.
