Your First Incident
What to expect after connecting your cluster.
After the agent connects, its first findings usually arrive within a minute. This page walks through what happens next.
First analysis
K8sGPT analysis runs inside the topology analyzer every 30 seconds and scans all namespaces and resource types. The watcher and log watcher report Warning events and log errors as they happen. If the agent detects any issues — a crashing pod, a pending PVC, a node under memory pressure — it reports them to the Hub.
Incident appears in the dashboard
Navigate to Incidents in the dashboard. Each incident shows:
| Field | Description |
|---|---|
| Resource | The Kubernetes resource kind and name |
| Namespace | The namespace the resource lives in |
| Severity | Critical, Warning, or Info |
| Cluster | Which connected cluster reported it |
| First seen | When the condition was first detected |
| Last seen | When the condition was last confirmed active |
AI enrichment
Within a few seconds of the incident appearing, the AI worker enriches it with:
- A plain-English explanation of what went wrong
- Relevant pod metrics (restart count, OOM events, last error reason)
- Node conditions at the time of detection
- Links to related incidents if the same condition has occurred before
Click the incident to open the detail view and read the enrichment.
Chat with the AI
Each incident has a built-in chat interface. You can ask questions like:
- “What is the root cause?”
- “Has this happened before in this namespace?”
- “What should I check first?”
The AI has access to the incident’s metrics, history, and cluster context when answering.
Resolve or assign
Once you have investigated an incident:
- Assign it to a team member using the assignee picker in the detail view
- Resolve it using the Resolve button when the condition is fixed
- Dismiss it if the condition is expected and does not need action
See Assigning and resolving for details.