> ## Documentation Index
> Fetch the complete documentation index at: https://docs.obsy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# RCA from an alert

> How automatic RCA works when an alert fires.

## Automatic trigger

When a **critical** alert arrives at your Obsy webhook endpoint, RCA starts automatically within seconds. You don't need to do anything.

The trigger threshold is configurable: by default, any alert with `severity: critical` triggers automatic RCA. Warning-severity alerts that have been firing for more than 15 minutes also qualify.

## What happens step by step

1. **Alert received** — Obsy receives the webhook payload from Datadog, Grafana, or New Relic.
2. **Alert normalized** — The payload is parsed into Obsy's common Alert entity (service, severity, signal type, labels).
3. **RCA queued** — A background job is created for AI analysis.
4. **Context gathered** — Obsy pulls recent deployments (from Change Intelligence), service dependencies (from the service catalog), and cluster events.
5. **AI analysis** — The AI model evaluates the context and produces a structured report.
6. **Report stored** — The RCA is saved and linked to the alert. If an incident was created, it's linked there too.
7. **Notification sent** — If Slack or email notifications are configured for incidents, a message with the RCA summary is included.

## Viewing the result

From the **Alerts** list, open the alert and click **View RCA** in the alert detail panel. The RCA detail page shows all sections of the report.

Alternatively, go to **RCA** in the sidebar to see all recent analyses sorted by time.

## Re-running an RCA

If new context has become available (e.g. a deployment was identified after the initial analysis), you can re-run:

1. Open the RCA detail page.
2. Click **Re-run analysis**.

The new report replaces the previous one and is re-linked to the alert and incident.