> ## Documentation Index
> Fetch the complete documentation index at: https://docs.healops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigations overview

Use this workflow when running HealOps via the local `healops` binary.

You can work in two ways:

* **Interactive prompt shell** — run `healops` with no subcommand (TTY) to enter the REPL: describe incidents conversationally, stream investigations, and use slash commands.
* **Direct investigation** — run `healops investigate` from your terminal with `-i` pointing at an alert payload (or `--interactive` to pick a file in the UI). The process runs and exits when the investigation completes.

## 1) Start an investigation

### Interactive shell (`healops`)

From a terminal with stdin and stdout attached (`healops` detects a TTY), run:

```bash theme={null}
healops
```

Then describe the incident or paste alert context at the prompt. Use `/help` for slash commands and `/exit` when finished.

When `LLM_PROVIDER` is `openai` or `codex`, `/effort` sets how much reasoning the model applies for that REPL session (`low`, `medium`, `high`, `xhigh`, or `max`). Run `/effort` with no arguments to print the current level and usage; `/status` includes the same field. Other providers ignore this setting (the shell prints a hint). You can also set `HEALOPS_REASONING_EFFORT` to `low`, `medium`, `high`, or `xhigh` in the environment for non-interactive defaults.

### Direct investigation (`healops investigate`)

Pass an alert payload to `healops investigate`:

```bash theme={null}
healops investigate -i tests/e2e/kubernetes/fixtures/datadog_k8s_alert.json
```

You can also use `--interactive` to pick an input file from your terminal UI.

## 2) Review investigation artifacts

A local run produces structured RCA artifacts such as:

* `problem.md` for incident framing and initial hypothesis
* `theory/hypothesis_*.md` for each hypothesis tested during the run
* `report.md` for final root-cause summary and next steps

If you want a single machine-readable output file, pass:

```bash theme={null}
healops investigate -i <alert-file> --output ./rca.json
```

## 3) Understand what HealOps analyzed

Each run captures:

* the original alert payload
* extracted context and normalized evidence
* tool outputs collected from connected integrations
* final diagnosis and recommended remediation steps

## Chat

For local binary usage, the primary workflow is file-based (`problem.md`, `report.md`, and optional JSON output).
You can open these artifacts in your editor and iterate from there (for example, by asking your editor's AI chat
to drill into specific hypotheses or evidence sections).

## Slack reports

If you've configured the Slack integration, HealOps can publish a concise incident summary into Slack after the
local investigation completes.

<Frame>
  <img src="https://mintcdn.com/healopsai/-Wx-FBGjzoPkZ7-9/images/slack_alert.png?fit=max&auto=format&n=-Wx-FBGjzoPkZ7-9&q=85&s=0d55f5b0b15fa4605742d418d7340f4b" alt="Slack Alert" width="1678" height="1954" data-path="images/slack_alert.png" />
</Frame>