Quick Start

Overview

This guide walks you through setting up IncidentFox for your team. By the end, you’ll have an AI SRE agent ready to investigate incidents from Slack.

IncidentFox is deployed as a managed service. Contact your account team for access credentials and your team token.

Step 1: Get Your Credentials

After onboarding, you’ll receive:

Team Token - Used to authenticate API requests
Web UI Access - Dashboard to configure agents and view investigation history
Slack App - Bot to install in your workspace

Your team token follows the format tokid.toksecret. Keep it secure and never commit to version control.

Step 2: Install the Slack Bot

The Slack bot is the primary interface for triggering investigations.

Install the App

Your IncidentFox admin will provide an installation link. Click it and authorize the app for your Slack workspace.

Invite to Channels

Invite @incidentfox to channels where you want to trigger investigations:

/invite @incidentfox

Test the Connection

Send a test message:

@incidentfox hello

The bot should respond confirming it’s connected.

Step 3: Configure Data Sources

Connect IncidentFox to your observability stack to enable investigations.

Via Web UI

Log in to your IncidentFox dashboard
Navigate to Team Console > Integrations
Click Add Integration and select your data source
Enter the required credentials

Common Data Sources

Platform	Required Credentials
Coralogix	API Key, Domain
Snowflake	Account, Username, Password, Warehouse
AWS	Access Key, Secret Key, Region
Datadog	API Key, Application Key
Grafana	URL, API Key
GitHub	Personal Access Token

See the Data Sources section for detailed setup instructions for each platform.

Step 4: Enable Tools

IncidentFox comes with 300+ built-in tools. Enable the ones relevant to your stack. In the Web UI:

Go to Team Console > Tools
Toggle on the tools you need
Configure any tool-specific settings

Example configuration:

{
  "tools": {
    "kubernetes": {
      "enabled": true,
      "kubeconfig_path": "~/.kube/config"
    },
    "aws": {
      "enabled": true,
      "region": "us-west-2"
    },
    "coralogix": {
      "enabled": true,
      "api_key": "vault://secrets/coralogix"
    }
  }
}

Step 5: Start Investigating

You’re ready to go! Try these commands in Slack:

Basic Investigation

@incidentfox investigate high latency in the payments service

Check Pod Status

@incidentfox check the status of cart pods in production

Analyze CI Failure

@incidentfox why did the build fail on PR #123?

Query Logs

@incidentfox search for errors in the checkout service logs from the last hour

What Happens During an Investigation

When you trigger an investigation, IncidentFox:

Acknowledges - Reacts to your message to confirm it’s working
Plans - The Planner agent creates an investigation strategy
Gathers Data - Pulls logs, metrics, and events from your data sources
Analyzes - Correlates data to identify root cause
Reports - Posts findings back to the Slack thread

Example Investigation Output

{
  "summary": "Payment service experiencing elevated latency due to database connection pool exhaustion",
  "root_cause": {
    "description": "RDS connection pool at maximum capacity (100/100 connections)",
    "confidence": 92,
    "evidence": [
      "CloudWatch RDS connections metric at 100%",
      "Application logs show 'connection timeout' errors",
      "Spike correlates with deployment at 14:32 UTC"
    ]
  },
  "timeline": [
    "14:32 - New deployment rolled out",
    "14:35 - Connection count started increasing",
    "14:42 - Connection pool exhausted",
    "14:43 - Latency alerts fired"
  ],
  "affected_systems": ["payment-service", "checkout-service", "RDS primary"],
  "recommendations": [
    "Increase RDS max_connections parameter",
    "Review connection pool settings in application config",
    "Consider rolling back deployment if issue persists"
  ]
}

Next Steps

Configure Agents

Customize agent behavior with system prompts

Add Data Sources

Connect all your observability tools

Set Up GitHub

Enable CI/CD auto-fix capabilities

View Tools Catalog

See all 300+ available tools

Getting Started

Core Concepts

Configuration

Integrations

Data Sources

Tools Catalog

Overview

Step 1: Get Your Credentials

Step 2: Install the Slack Bot

Step 3: Configure Data Sources

Via Web UI

Common Data Sources

Step 4: Enable Tools

Step 5: Start Investigating

Basic Investigation

Check Pod Status

Analyze CI Failure

Query Logs

What Happens During an Investigation

Example Investigation Output

Next Steps

Configure Agents

Add Data Sources

Set Up GitHub

View Tools Catalog

​Overview

​Step 1: Get Your Credentials

​Step 2: Install the Slack Bot

​Step 3: Configure Data Sources

​Via Web UI

​Common Data Sources

​Step 4: Enable Tools

​Step 5: Start Investigating

​Basic Investigation

​Check Pod Status

​Analyze CI Failure

​Query Logs

​What Happens During an Investigation

​Example Investigation Output

​Next Steps

Configure Agents

Add Data Sources

Set Up GitHub

View Tools Catalog

Overview

Step 1: Get Your Credentials

Step 2: Install the Slack Bot

Step 3: Configure Data Sources

Via Web UI

Common Data Sources

Step 4: Enable Tools

Step 5: Start Investigating

Basic Investigation

Check Pod Status

Analyze CI Failure

Query Logs

What Happens During an Investigation

Example Investigation Output

Next Steps