On-call features

​

At a glance

---

​

Agentic investigation

The part that is not scheduling. A standing team of five AI agents — Incident Commander, Log Analyst, Infrastructure Specialist, Communications Lead, Knowledge Engineer — works each incident, deciding what to look at next from what it just found.

• No rules to pre-write. No runbook, no alert-to-action mapping, no decision tree to keep current.
• Runs on a cycle, triggers immediately on an alert, and schedules its own follow-ups. The cycle tightens while an incident is live.
• Nine tools across the team: query logs, group errors, search your repository, search the knowledge base, analyze context, open and update incidents, notify responders, attempt recovery.
• The page carries the findings — root-cause hypothesis, evidence, suggested fix.

Full detail in Agentic on-call.

​

Schedules and rotations

• Layers. A schedule is built from independently rotating layers — Primary, Secondary, as many as you need.
• Rotation types. Daily, weekly, or custom with a shift length in hours. Custom is how follow-the-sun coverage gets built.
• Timezone per schedule. An IANA timezone on the schedule itself, so handoffs land at the right local hour.
• Handoff times. An explicit local time of day that a shift changes hands.
• Restrictions. Limit a layer to particular days and hours — business hours only, weekends only, weeknights only. Windows may cross midnight.
• Overrides. Substitute a person into any window for leave or a swap, scoped to one layer or to the whole schedule, with a note explaining why.
• Rotation order. Members rotate in the order listed, so the handoff sequence is explicit rather than inferred.

Detail in Schedules and rotations.

​

Escalation policies

• Ordered levels. Each names its targets and how long to wait.
• Per-level acknowledgement timeout, in minutes. No acknowledgement, next level, automatically.
• Three target kinds — an individual, an entire on-call schedule (resolved at escalation time, so it always reaches whoever is genuinely on call), or an escalation team.
• Per-level channels. Start on Slack during the day, end on SMS at 3 AM.
• Repeat. Re-run the whole chain a set number of times if the incident is still unacknowledged.
• Organization default. A fallback policy so nothing is ever raised with no escalation path.
• Policy resolution by specificity — the on-call agent’s policy, then the client’s, then the organization default. Failing all three, a chain is derived from the agent’s rotations. The agent’s card shows how each rotation resolves.
• Preview. Dry-run a policy and see exactly who it would page at each level, right now or at any timestamp you choose, with current rotations and overrides applied.

Detail in Escalation policies.

​

Escalation teams

A named group with its own members, targetable by an escalation level as a single unit. Useful when a whole team should be pulled in at once rather than one person at a time, and it keeps policies stable as team membership changes.

​

Notifications and paging

Six channels, configurable per escalation level: Every page carries the severity, the summary, what the investigation found, and a one-tap acknowledge link that stops the escalation immediately. Detail in Notifications.

​

Guided setup

You do not have to hand-build the first configuration. WHAWIT will propose a complete one — escalation teams, schedules and policies — from a short description of your team. Three ways to give it the roster: Then a handful of questions — timezone, rotation type, handoff time, whether you want a single tier, two tiers, or follow-the-sun, the acknowledgement timeout, and how many times to repeat — and it returns a proposal you review and adjust before anything is created. Detail in Guided setup.

​

Live activity

The agent team is not a black box. Clicking an agent card that carries the AI Agents badge opens a view of the team as a diagram — the agents, the tools they are reaching for, the knowledge base they are reading and writing, and where each investigation ended up — plus an activity timeline of what happened on an incident and when. The agents screen is the front door to it.

​

Knowledge base

The Knowledge Engineer writes back what each incident established. Recurring failures are met with what the previous occurrence cost you to learn, instead of being investigated from scratch every time.

​

Incident coordination

Paging gets the right person awake. Coordination is what happens next:

• A dedicated Slack or Microsoft Teams channel for the incident, with responder roles assigned.
• A living timeline of what was done and when.
• Drafted status updates, so responders respond instead of narrating.
• A drafted postmortem built from the timeline once it is over.
• Tickets synced to Jira, GitHub or Azure DevOps.

​

Alert intake and migration

WHAWIT correlates and deduplicates the alerts arriving from your connected providers, so one underlying failure raises one incident rather than forty notifications. It can also ingest alerts from PagerDuty and Opsgenie, which is how teams evaluate it against live incidents before moving any rotation. A migration path, not a dependency — see Migrating.

​

Related