Skip to main content

Overview

The Slack bot is the primary interface for triggering IncidentFox investigations. Mention the bot in any channel to start an investigation.

Prerequisites

  • Slack workspace admin access
  • IncidentFox account with Slack integration enabled

Setup

Step 1: Install the App

Your IncidentFox admin will provide an installation link:
Click the link and authorize the app for your workspace.

Step 2: Configure Required Permissions

The app requests these permissions:

Step 3: Invite to Channels

Invite the bot to channels where you want to use it:
Add the bot to your incident channels so it’s ready when you need it.

Step 4: Test the Connection

Send a test message:
The bot should respond with a confirmation.

Usage

Basic Investigation

Check Specific Resources

Query Logs

Get Help

Response Format

When you trigger an investigation, IncidentFox:
  1. Reacts with emoji to acknowledge
  2. Creates a thread for the response
  3. Posts structured findings:
    • Summary
    • Root cause
    • Evidence
    • Timeline
    • Recommendations

Example Response

Configuring Data Sources

Once the IncidentFox bot is installed, team members can configure data source integrations directly from Slack.

Opening the Configuration Panel

There are two ways to access the configuration panel: Option 1: Welcome Message When IncidentFox joins a new channel, it posts a welcome message with a Configure button. Click this button to open the configuration panel. Option 2: App Home
  1. Click on the IncidentFox bot’s avatar in any channel
  2. Click Open App
  3. You’ll see:
    • Connected Integrations - Data sources already configured (click Edit to modify)
    • Available Integrations - Data sources you can add (click Connect to set up)

Configuration Modal

When you click Connect or Edit for any integration, a modal appears with:
  1. Video Walkthrough - Step-by-step guide for setting up the integration
  2. Setup Instructions - Quick reference for creating API keys
  3. Configuration Fields - API key, domain, and integration-specific settings
  4. Custom Context (Optional) - Additional context to help the AI understand your setup
Credentials are encrypted and stored securely. You can revoke access at any time by deleting the integration.
See individual data source pages for specific setup instructions:
  • Coralogix - Log search, metrics, and alerts
  • Datadog - Metrics, logs, and APM
  • AWS - CloudWatch and infrastructure

Configuration

Default Slack Channel

Set a default channel for notifications:

Bot Response Style

Configure in agent prompts how the bot communicates:

Commands Reference

Troubleshooting

Bot Not Responding

  1. Verify bot is invited to the channel
  2. Check bot is online in Slack
  3. Ensure mention includes @incidentfox

Permission Errors

  1. Re-authorize the app
  2. Check channel permissions
  3. Verify bot token is valid

Slow Responses

  1. Complex investigations take 30-60 seconds
  2. Check data source connectivity
  3. Review configured timeout settings

Best Practices

  1. Use dedicated channels for incidents
  2. Include context in your request
  3. Use threads to keep conversations organized
  4. React to helpful responses to improve the model
  5. Share dashboards the bot references

Next Steps

GitHub

Set up GitHub bot

Configuration

Customize bot behavior