Agentic RCA
Agentic RCA (root-cause analysis) means solving IT problems with an AI that analyzes rich device telemetry in seconds.
An investigation can start from a ticket, or from a hunt for problems nobody has reported yet. Most are interactive. You ask, and your AI investigates the way a senior engineer would: it checks the signals, the device's state at that moment, what changed beforehand, and whether other devices are affected, following each finding to the next question. You ask follow-ups until the problem is clear.
When you want it written down, ask for a full RCA report. Every claim in the report links to the data behind it, and the report lists what it could not see, so you can attach it to the ticket and stand behind it with a client.
Every engineer gets the same depth of investigation, whoever picks up the ticket. Candidate causes are a labeled step of their own, and the engineer decides what to do.
Chat or a written report
With any connected AI, through the plugin or MCP alone:
- Chat with it and ask follow-ups. It uses the same data and tools however you connect, and can go as deep as the problem needs.
- Ask it to write up what it found, summarize for a handoff, or explain why it said something.
- Each fact it states links to the device page or the query behind it in the app.
With the SparkLogs AI plugin for Claude, Cursor and Codex, two skills produce formal documents:
| Skill | What it produces |
|---|---|
sparklogs-investigate | A structured report of what was observed, with every claim cited and a list of what was not checked. |
sparklogs-analyze-cause | Candidate causes drawn from that report, labeled as analysis, each with the check that would confirm it or rule it out. |
A formal report takes longer than a chat answer because it gathers, cites and structures everything it reports. Ask for one when you want the document.
For Microsoft Copilot Studio and other agents that connect over MCP, the instruction template tells the agent how to work the data, cite its evidence and say what it could not check.
What an investigation report contains
sparklogs-investigate returns a system condition summary: what was observed in the time window, with each claim linked to the query behind it.
Open any link in Explore to check it.
For a failed backup, the report goes beyond the error line. It covers the VSS writer state when the job ran, free space on the target volume, what was installed that morning, and whether other machines at the client failed the same way.
The report also lists what it did not check because the agent cannot see it, such as a backup target with no agent, an EDR cloud console, or a network path. Read that list before you rely on the report.
To watch a full investigation, open the live demo.
Cause analysis with the plugin
In a chat, your AI will usually offer likely causes as it goes.
For a formal report, the plugin keeps them apart: sparklogs-analyze-cause works from a finished report.
It labels its output as analysis, ties each candidate cause to findings in the report, and names the check that would confirm it or rule it out.
Where the evidence runs out, it says so.
Keeping causes in their own step keeps the report itself to what was observed.
AI Trust Principles
Investigations follow ten AI Trust Principles. You stay in charge, you can check every answer, and you control and can review what the AI does.