System threads: turning an alert into a shared agent conversation

TL;DR

An alert from a monitoring tool is usually a dead-end notification.

I designed system threads: an external alert (for example from Coralogix) arrives as a first-class message that materializes into a shared agent thread, so the whole org can jump in and work the incident with the agent together.

The problem

Alerts land in one place, the investigation happens somewhere else, and the knowledge lives in one person's DMs.

There was no shared surface where an alert, the agent's investigation, and the team's decisions lived together. Incident response was fragmented and non-collaborative.

The insight

An alert is just another participant in the conversation.

If a third-party event can post into a thread and that thread is shared, the agent's investigation becomes a team artifact instead of a private chat.

The solution

• A third-party alert renders as an alert card (branded source avatar, source label, timestamp, the alert payload, open action) that seeds an agent thread.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9An alert seeding a shared agent thread the team works together

• The agent responds with a single consolidated investigation: root-cause narrative, a dependency graph, a rollback PR card, closing notes.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9

• The shared thread surfaces indicators for new agent messages and for when the agent is awaiting approval to use a tool, so anyone watching knows when to look or step in.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9

• Because the thread is shared org-wide, any member can open it, see what the agent found, and act, with approval gating on anything destructive.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9

• The thread header carries a generic source badge, so any future alert source reuses the same pattern.

Impact

Turned one-way alerts into shared, actionable investigations the whole team can collaborate on with the agent.

Reflection

Treating the alert as a first-class input, not a dead-end notification, was the move.

It can open a shared thread the whole team works together, or fire a playbook that handles it automatically. Either way, incident response stopped being tribal knowledge.