Workflow · Operate

Incident triage

When something breaks, start from what changed. The crew correlates the symptom with deployments, config and dependencies, and proposes a mitigation.

When to use it

Errors spike, a page goes down, a customer emails. You want the likely cause and the safest next step, with evidence.

Crew constellation: Kapten at the centre, linked to Lookout, Helmsman.LookoutStages 1 · 2HelmsmanStages 1 · 4Kapten2 steps · orchestrates
Kapten briefs each specialist in stage order and merges what they send back.
Specialists
3
Stages
5
Tier
Plan → Act
Duration
Minutes

Start it with one prompt.

Paste it into Claude Code, Claude Desktop or Cursor once Kapten is connected. Replace the names with yours; Kapten asks for anything it cannot infer.

Connect your agent
prompt
Checkout is returning 502s in production since about 14:10. What changed, and what is the safest way to stop the bleeding?
Simulated run
  1. You ask

    › Checkout is returning 502s in production since about 14:10. What changed, and what is the safest way to stop the bleeding?

  2. Stage 1 · 2 agents in parallel

    • LookoutObservability & incidents

      Scope the symptom

      Which services, since when, how many requests. Reads the error rate, latency and restarts around the window.

    • HelmsmanReleases

      List what changed

      Deployments, config changes, secret rotations and scaling events in the same window.

  3. Stage 2

    • LookoutObservability & incidents

      Read the evidence

      Pulls the relevant log lines from the affected service and its upstreams and matches them to a change.

  4. Stage 3

    • KaptenOrchestration

      Likely cause and options

      Proposes a cause with its evidence, and ranked mitigations: roll back, scale, or toggle config.

  5. Gate 01 · stops for your approval

    Approve the mitigation

  6. Stage 4

    • HelmsmanReleases

      Mitigate

      Applies the mitigation you approve, then watches health until the error rate returns to baseline.

  7. Stage 5

    • KaptenOrchestration

      Draft the postmortem

      A timeline from the first error to recovery, the cause and the follow-ups to schedule.

  8. You get

    • Likely cause with log and metric evidence
    • A mitigation applied with your approval
    • A postmortem draft with a timeline

Related guide

An observability starter kit for a small team

Read the guide ↗

More workflows

Keep the crew busy.

Build with Kapten

Start with one service.
Build from there.

Tell us what you want to deploy. We review each request and follow up about fit and onboarding on your preferred cloud.

Free during early access. No card required. Cloud usage billed separately.