---
title: Incident Root Cause Analysis
description: An incident that only says "down" leaves you doing the detective work at 3 a.m. Every incident now shows exactly why it fired: the condition that failed, the…
canonical: https://watchfor.io/changelog/2026-04-19-incident-root-cause
---

[All updates](/changelog/page/10#2026-04-19-incident-root-cause) ✨ New Apr 19, 2026 · v 1.0.0

# Incident Root Cause Analysis

An incident that only says "down" leaves you doing the detective work at 3 a.m. Every incident now shows exactly why it fired: the condition that failed, the check results that confirmed it, and the alert rule that was in effect at that moment. Open any incident to see it.

Expected next to Detected for every incident. The summary and likely causes were added in July.

## What the analysis shows

- Diagnosis : the failing condition as a title, such as Unexpected HTTP Status , Connectivity Failure or High Response Time , with its severity.

- Expected vs. Detected : what the rule required next to what was measured, for example "status in 2xx/3xx" against "503", or "response time within 2000 ms" against "4.2 s".

- Confirming probes : the actual checks that confirmed the failure, each with its location, time, status code or error.

## The rule as it was

Alert rules are versioned. An incident is always judged against the rule version that was in effect when it fired, and the panel shows that version as "Expected". If someone changes the rule while the incident is open, each later version appears as an Updated entry with the change highlighted. You can see that a threshold was raised at 10:42 and that the incident was judged against the old one.

## Example

Your API monitor fires at 09:08. The panel reads Unexpected HTTP Status , Expected "status in 2xx or 3xx", Detected "403", and lists the three checks that saw it. Before opening a terminal you already know the server answered, but refused the request.

Open any incident from Incidents to see it. Details: [Root cause analysis](/docs/alerting/root-cause).

Since then, every incident also opens with [a plain-language summary, the likely causes and copy-paste diagnostics](/changelog/2026-07-24-incident-explanations), as in the screenshot.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-04-19-incident-root-cause · Site guide: https://watchfor.io/llms.txt