> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# The 6-stage incident lifecycle

> Detection → triage → diagnosis → resolution → verification → closure — what happens at each stage

Every incident in sureops moves through six stages. Each stage has a dedicated AI specialist agent, a defined set of outputs, and clear handoff criteria to the next stage. You can run the full pipeline autonomously, step through it in Supervised mode with human approval at each gate, or take manual control of any stage at any time.

***

## The six stages

<Steps>
  <Step title="Detection">
    **What it is:** The moment sureops receives an alert or detects an anomaly across your observability stack.

    **What sureops does:** Ingests the alert, deduplicates against any open incidents, and opens a new incident record. The incident commander agent runs an initial context read — pulling relevant alerts, service metadata, and recent deployment activity — to prepare for triage.

    **What you see:** A new incident appears in the Command Center with its triggering alerts listed.
  </Step>

  <Step title="Triage">
    **What it is:** Rapid severity assessment and impact scoping before deep investigation begins.

    **What sureops does:** Assigns a P1–P4 severity based on alert priority, affected service tier, and business impact signals. Deduplicates overlapping alerts. Identifies which services and dependencies are in scope and routes the incident to the right responder if on-call routing is configured.

    **What you see:** Severity badge, affected service list, estimated user impact, and initial responder assignment.
  </Step>

  <Step title="Diagnosis">
    **What it is:** Root cause analysis — the deepest and most tool-intensive stage.

    **What sureops does:** The diagnosis specialist agent runs a ReAct investigation loop, pulling metrics, logs, traces, and Kubernetes state through your connected integrations. It correlates signals across services, follows the dependency graph to identify blast radius, and produces a set of ranked recommendations with confidence scores and supporting evidence.

    **What you see:** A structured root cause analysis, per-recommendation confidence, and (if applicable) proposed change tickets. In Supervised mode, this stage always pauses for your approval before any action proceeds.
  </Step>

  <Step title="Resolution">
    **What it is:** Executing the fix.

    **What sureops does:** The resolution specialist executes approved recommendations. Depending on the recommendation type, this may mean restarting a deployment, scaling a resource, rolling back to a previous image via ArgoCD, or opening a draft fix PR against your repository. High-risk actions always require explicit human approval — even in Self-Driving mode.

    **What you see:** A real-time execution log with each action's status (applied / failed / skipped). If a fix PR is opened, a link appears directly in the incident timeline.
  </Step>

  <Step title="Verification">
    **What it is:** Confirming the fix actually worked before declaring the incident resolved.

    **What sureops does:** Re-queries the same metrics and service health checks that fired the original alert. Validates that they are back within baseline thresholds. If recovery isn't confirmed, sureops escalates rather than silently retrying — it never marks an incident resolved when it can't verify.

    **What you see:** A metric comparison table (baseline vs. current vs. status) and a clear pass/fail verdict. If verification fails, the incident stays open and you are notified.
  </Step>

  <Step title="Closure">
    **What it is:** Wrapping up the incident with a durable record.

    **What sureops does:** Generates an executive-ready root cause analysis document, opens a Problem Record for recurring-pattern tracking, and embeds the incident into the knowledge base for future diagnosis context. The timeline, all agent findings, and any human overrides are preserved.

    **What you see:** A completed incident with a shareable RCA, links to any opened change tickets or fix PRs, and (if applicable) a new Problem Record in the Problems view.
  </Step>
</Steps>

***

## Stage flow at a glance

| Stage        | Agent                   | Key output                                  | Human approval required?                           |
| ------------ | ----------------------- | ------------------------------------------- | -------------------------------------------------- |
| Detection    | Incident Commander      | Incident record, triggering alerts          | No                                                 |
| Triage       | Incident Commander      | Severity, affected services                 | No (configurable for P1/P2)                        |
| Diagnosis    | Diagnosis Specialist    | Root cause analysis, ranked recommendations | Always in Supervised; configurable in Self-Driving |
| Resolution   | Resolution Specialist   | Execution log, fix PRs                      | Always for high-risk actions                       |
| Verification | Verification Specialist | Recovery confirmation                       | No                                                 |
| Closure      | Incident Commander      | RCA document, Problem Record                | No                                                 |

<Note>
  After closure, any recurring pattern automatically creates a **Problem Record** — a longer-lived investigation object that links related incidents and tracks whether the underlying root cause has been permanently addressed. See [Problem records](/next/using-sureops/problems) for details.
</Note>

***

Next: [Control modes — Supervised and Self-Driving](/next/getting-started/core-concepts-control-modes)