AI incident investigation before anyone is paged

What does the AI investigation produce?

For each new incident, the model receives the title, description, severity, source and raw alert payload, and returns a structured verdict. It is instructed not to invent details the alert does not support and to recommend paging whenever in doubt.

The analysis panel on the incident is marked as AI-generated, with a reminder to verify before acting.

• Summary — one or two sentences on what the alert means.
• Probable cause — the most likely root cause, or nothing if the alert carries too little signal.
• Suggested first step — the first concrete thing the responder should check.
• Recommendation — page normally, or treat the event as noise.
• Confidence — a score from 1 to 10.

Can AI stop a noisy alert from calling me?

Only if you turn that on. By default the AI only analyses: it never silences anyone and never changes an escalation policy.

A separate, opt-in setting lets it skip the phone call for events it judges to be clear noise, such as a self-recovered blip, a heartbeat or test ping, or an obvious false positive.

Even then the incident is still created and the on-call engineer is still notified by push, SMS and email; only the call is spared. Every muted call is recorded on the incident timeline as “AI muted the phone call”, so you can audit each decision.

Which AI provider does Oncallz use, and where does my data go?

Oncallz uses your own API key; there is no shared platform key, so AI features stay off until you add one. Today the supported provider is DeepSeek. You can leave the model empty to use the provider’s default or name a specific one.

The key is verified with the provider when you save it and stored encrypted.

Be clear about what that means: with investigation enabled, each incident’s title, description, severity, source and raw alert payload are sent to the AI provider under your account and its terms.

Strip secrets or personal data you do not want to leave your monitoring stack from alert payloads, or keep AI investigation off. Every request and response is visible in the AI request history.

What else does the AI do?

The same key powers three more features, all run on demand or on a schedule you control:

• Duplicate incident analysis — on the analytics page, the AI reads the alert titles in a date range, clusters the ones that describe the same problem and proposes a grouping template with * wildcards, so they fold into one incident from then on. You review and adopt each template yourself.
• Team scheduling analysis — reviews a team’s last 30 days and next 14 days of on-call for coverage gaps, overloaded people, override churn and escalation problems.
• Daily digest — a morning email to owners and admins with an AI briefing on the previous day’s incidents.

How do you know whether the AI is any good?

Responders rate each analysis as accurate, helpful or incorrect, with an optional comment, and the rating stays on the incident. Over time that shows whether the analyses are worth reading for your alerts.

The request history also lists latency, token usage and an estimated cost for each call; your provider’s invoice remains the authoritative figure.