Your First Incident
What to expect after connecting your cluster.
After the agent connects, it runs its first analysis within 5 minutes. This page walks through what happens next.
First analysis
The K8sGPT sidecar scans all namespaces and resource types. If it detects any issues — a crashing pod, a pending PVC, a node under memory pressure — it reports them to the Hub.
Incident appears in the dashboard
Navigate to Incidents in the dashboard. Each incident shows:
| Field | Description |
|---|---|
| Resource | The Kubernetes resource kind and name |
| Namespace | The namespace the resource lives in |
| Severity | Critical, Warning, or Info |
| Cluster | Which connected cluster reported it |
| First seen | When the condition was first detected |
| Last seen | When the condition was last confirmed active |
AI enrichment
Within a few seconds of the incident appearing, the AI worker enriches it with:
- A plain-English explanation of what went wrong
- Relevant pod metrics (restart count, OOM events, last error reason)
- Node conditions at the time of detection
- Links to related incidents if the same condition has occurred before
Click the incident to open the detail view and read the enrichment.
Chat with the AI
Each incident has a built-in chat interface. You can ask questions like:
- “What is the root cause?”
- “Has this happened before in this namespace?”
- “What should I check first?”
The AI has access to the incident’s metrics, history, and cluster context when answering.
Resolve or assign
Once you have investigated an incident:
- Assign it to a team member using the assignee picker in the detail view
- Resolve it using the Resolve button when the condition is fixed
- Dismiss it if the condition is expected and does not need action
See Assigning and resolving for details.