Incident summarization
The Instana incident summarization uses generative AI to summarize an incident with data that is extracted from the impacted entity, related events, and affected entities for the incident. The generative AI also summarizes any notes made within the incident, including comments from ServiceNow (bidirectional flow must be enabled). The triggering entity for the incident is identified by using the topology of the resource (for example: Kubernetes pod, application, service, and node) where the incident occurred. This feature is available from the Summary and notes with AI pane for an incident when you are viewing the incident details.
By using this feature that you can generate a concise incident and notes summary, which includes the start, end, duration, severity, and current status of the incident. You can use this summary to identify root-cause issues more efficiently and achieve quicker resolutions. The generated summary can also be shared to allow for visibility across your team.
Prerequisites
You can use Instana incident summarization only if the following prerequisite conditions are met:
- SaaS environments
For SaaS environments, default LLM gateways are provided by Instana. No additional configuration is required to use this capability. You can configure separate gateways for your own runtime if desired. For more information, see Configuring LLM gateways.
- Self-hosted environments
For Standard Edition and Custom Edition, you must enable the required feature flag and configure LLM gateways to use this capability. For more information, see Configuring LLM gateways.
The support for self-hosted LLM gateways is currently limited to an LLM available with Watsonx on-prem (see Supported LLM services for details on supported deployments). Summarization is designed to work with the mistral-medium-2505 and Granite family models.
You must also set the
feature.incident.ai.summarization.enabledfeature flag, see self-hosted optional flag incident summarization.
Generating the summary
- From the Events page Incidents tab, select the incident that you want to summarize.
- Click Summary and notes with AI to open the Summary and notes with AI pane.
- Click Generate a summary.
- The summary of the incident, notes, and incident details is generated and displays on the pane.
Generated summary content
- Incident details
Each summary includes general information of the incident that includes:
- Start time
- End time
- Duration
- Severity
- Status
- Triggering Entity
- Summary of the incident
A concise summary of the incident and its details.
- Summary of notes
This section summarizes all notes that are recorded in the Summary and notes with AI section of an incident. It includes the notes imported from ServiceNow when a bidirectional flow is enabled, up to the time when the summary is requested.
- Actions
There are two actionable buttons available for the summary:
- View recommended actions: scrolls the current incident page so that the recommended actions are in view.
- Share: Opens an in page modal that you can use to share the summarization through email. All content in the generated summary is copied into the body of the draft email.
Data fields that are used for summary generation
- dent:
- Triggering event problem description and details fields
- Event specification ID
- Related events:
- Affected entities
- Notes:
- Text content
Sharing incident summaries
You can share an incident summary by clicking Share. The system opens an in-page modal to share the summary by email. The generated summary content is automatically copied into the email body.
To tailor the summary for your intended audience, select the appropriate role from the dropdown menu. When you select a different role, AI regenerates the summary from that role's perspective, providing information most relevant to that recipient.
Supported roles
SRE (default): Ensures system reliability, resilience, and scalability by minimizing downtime and responding quickly to incidents. Focuses on automation, performance, and operational stability across services.
DevOps: Builds and maintains CI/CD pipelines and infrastructure to enable smooth, automated deployment and operations. Focuses on system reliability and resolves infrastructure-related issues.
Developer: Designs, writes, and maintains application code to build features that meet business needs. Troubleshoots bugs, improves performance, and enhances application functionality through continuous development.
Executive: Oversees technology strategy and prioritizes business impact, service availability, and organizational risk. Requires high-level insights only, without system names, technical root causes, or remediation details.
IT manager: Leads IT operations and make sure that infrastructure, services, and teams meet organizational SLAs. Coordinates incident response, resource allocation, and operational planning across technical teams. Focuses on coordination and resource allocation.
End user: Uses the product or service and needs clear, simple information about what is working or not working. Requires nontechnical updates that are focused on impact and service status.
Large language model - Mistral
The large language model (LLM) that is used for generating the summary is mistralai/mistral-medium-2505. This model can be modified and configure the the use of the AI gateway feature. For more information about that feature, see AI Gateway.
Troubleshooting
If you are unable to generate a summary ensure that the AI Gateway is enabled and properly configured.