Real-time incident detection monitors your incoming support conversations and automatically surfaces emerging incidents before they escalate. Use this article to understand how detection works, configure Slack, email, and webhook alerts, triage detected issues in the incidents feed, and respond to affected customers — all without leaving your Fin workspace.

Real-time incident detection continuously monitors incoming support conversations to identify emerging incidents as they happen.

There's nothing to configure and no metrics or thresholds to set. The AI recognizes when something unusual is happening across your incoming conversations and tells you what's driving it.

It moves teams from a reactive model, where incidents are discovered after they escalate, to a proactive one, where incidents are identified while they are still forming.

Real-time incident detection works in four phases — from spotting a problem in your conversations, to alerting your team, to helping you understand and respond to it.

As conversations come into your Fin inbox, the AI automatically categorizes each one into a topic and continuously monitors volume across each topic. No setup or predefined conditions are required. Detection works in six steps: 1. Categorization — each incoming conversation is automatically assigned to a topic. 2. Volume monitoring — every few minutes, the system checks how many conversations have arrived for each topic over the last 5, 10, 15, and 30 minutes, and compares that against the historical baseline for the same time of day — so it's always comparing like for like. 3. Spike confirmation — when a topic shows a meaningful spike, a statistical check confirms it's genuinely unusual and not just normal variation. 4. Root cause analysis — the conversations driving the spike are analyzed and compared against typical conversations for that topic, to identify what's actually different about them. 5. Incident creation — if the spike represents a real incident, an Incident is created with an AI-generated summary of what customers are experiencing. 6. Tagging — all related conversations, both past and future, are automatically tagged as Affected Conversations.

The moment an Incident is detected, your team is notified via Slack, email, or webhook so you can respond immediately, even outside working hours. You can filter alerts by topic to route incidents to the right team. Alerts include a plain-language summary of the incident, the number of affected conversations, the impacted topic, and a direct link to investigate in Fin.

The Incidents page (Analyze > Incidents) gives your team a full record of everything detected, ordered by detection date. Click into any Incident to open the detail panel, where you'll find an AI-generated summary of what's happening, the affected conversation count, a chart showing how the spike developed over time, and the full list of affected conversations so you can see exactly what customers are saying.

When you open an Incident, Operator (your AI assistant) opens alongside it — already loaded with the full context of the incident. From there you can ask questions about the incident, send a bulk message to all affected customers, close impacted conversations once the incident is resolved, or create a Fin snippet so Fin can respond accurately to any new customers who contact you about it while the incident is still active.

Go to Analyze > Incidents to get started.

When you open an Incident, Operator opens alongside it — already loaded with the full context of the incident. You can:

Go to Analyze > Incidents and click the bell icon in the top right of the Incidents page to configure alerts.

You can receive notifications via Slack, email, webhook, or any combination — alerts fire the moment an incident is detected, including outside working hours.

The trigger is set to New incident detected by default. You can also add a topic filter to route alerts for specific topics to the right team, and combine multiple actions — for example, sending a Slack message to your support channel and an email to your engineering lead.

Every alert includes an AI-generated summary of the incident, how many more conversations than usual are affected and over what period, when the incident started (not just when it was detected), the impacted topic, and a direct link to investigate in Fin.

Webhook alerts send incident details to an external system or workflow the moment an incident is detected. Use them to be notified about incidents being created or updated in any external system.

To manage existing alerts, click the bell icon and use the ••• menu next to any alert to edit, test, or delete it.

Click the report icon on any incident to generate a report over all affected conversations. The report includes:

Go to Analyze > Incidents. The Incidents feed lists all detected incidents, ordered by detection date. Each row shows the incident title, AI-generated summary, impacted topic, affected conversation count, detection time, and a mini volume chart. Active incidents are shown with a red border; closed incidents are greyed out.

Click any incident to open the detail panel, which includes: