Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →An incident agent that remembers why earlier fixes failed needs three things: structured incident episodes (not raw transcripts), retrieval that treats an old incident as a precedent to be checked rather than an instruction to be repeated, and a review loop that keeps stored lessons current. Everything below is a design guide built from published guidance by Microsoft, Google and AWS. It is not a report of a finished build, and it makes no claim about how any particular agent performs.
The question you want the agent to answer is not only “How did we fix this before?” but “What did we try last time, and why didn’t it work?” The second question is harder, because it needs outcomes, context and evidence, not just a list of past tickets.
As an Amazon Associate I earn from qualifying purchases.
Keep three kinds of knowledge separate
Azure’s documentation for its SRE Agent memory describes searching three different stores together: past incidents, user memories (saved facts), and knowledge documents. They answer different questions, and a design that blends them into one pile of text loses that distinction.
- Incident episodes record what happened once: symptoms, actions, outcomes. They answer “How did we fix this before?”
- Saved environment facts are durable statements about your estate, such as which service owns a queue or which region is a failover target. They can be wrong, but they are meant to be true now.
- Documentation and runbooks encode intended procedure. They say what should work; episodes say what did work, or didn’t, on a given day.
Runbooks and episodic memory complement each other. When they disagree, that disagreement is itself useful information to show the responder, not something for the agent to resolve silently. Old memory should never quietly override current monitoring or current runbook guidance.
#1 Best Overall
What an incident episode should contain
Azure’s documented extraction covers symptoms, successful resolution steps, root cause and pitfalls. Microsoft Research’s FLASH paper (2024), which studies diagnosis of recurring incidents, adds the idea of using historical diagnosis paths and hindsight. Combining the two, a useful episode is richer than a summary. The fields below are a design synthesis, not a standard schema from any of those sources.
| Field group | What to store | Why it matters |
|---|---|---|
| Identity and provenance | Incident ID, link to the original incident or conversation, who recorded the learning | A responder must be able to inspect the evidence behind any claim the agent makes |
| Scope | Affected service and resources, environment, version or deployment, time | Lets retrieval and the agent test whether today’s situation really matches |
| Symptoms | Alerts, error signatures, supporting observations (metrics, log patterns) | The primary retrieval keys, and the basis for comparing “what matched” |
| Hypotheses | What was suspected, and what ruled each one in or out | Preserves dead ends, which are often the most reusable part |
| Actions | Each diagnostic step and remediation attempt, in order, with timestamps | Separates what was tried from what happened afterwards |
| Outcome | Observed result of each action and the time window used to judge it | “Recovered” means little without a window and a signal |
| Assessment | Root-cause statement, confidence, and an explicit “outcome unclear” option | Stops uncertainty from hardening into fact |
| Lessons | What succeeded, what failed, pitfalls, and the conditions under which each held | The payload the agent actually surfaces |
An illustrative episode
The record below is invented to show the shape; it describes no real incident.
{
"incident_id": "INC-0000 (example)",
"service": "checkout-api",
"environment": "prod, release 2.14.x",
"symptoms": ["p99 latency up", "connection pool exhausted errors"],
"attempts": [
{
"action": "restart checkout-api pods",
"observed": "errors cleared for ~10 min, then returned",
"judged_over": "30 min",
"verdict": "failed (no lasting effect)"
},
{
"action": "raise pool size from 50 to 100",
"observed": "errors cleared; database CPU rose",
"judged_over": "60 min",
"verdict": "mitigated, not root cause"
}
],
"root_cause": {
"statement": "slow query introduced in release 2.14.x holding connections",
"confidence": "medium",
"evidence": ["slow-query log excerpt", "deploy timeline"]
},
"caveats": "restart would likely help if the cause were a leaked connection rather than slow queries",
"source_link": "link to original incident thread"
}Notice that the failed restart is stored with its observed effect and a time window, not as “restart does not work”.
Separate “attempted” from “caused the resolution”
The most common way an incident memory misleads is by treating sequence as causation. A fix applied shortly before recovery may have had nothing to do with it: a traffic peak ended, a dependency recovered, or a second change landed. The cited sources do not define a causal-attribution schema, so this is a design recommendation: store the action, the evidence observed afterwards, and the operator’s assessment as separate fields, and let the record say the outcome is unclear.
The mirror-image mistake is flattening a failed action into a permanent prohibition. A restart that did nothing for a slow-query problem may be the right first move for a leaked connection. Store the conditions under which an action failed, not a universal “never do this”.
AWS’s Well-Architected Agentic AI Lens states the goal directly: “Knowledge about successful interventions is captured alongside failure modes, so what works is remembered as reliably as what failed.” Both halves need to be written down with equal care.
Retrieval: find precedents, then test the match
Google’s SRE guidance describes an incident-hypothesis system that synthesizes real-time monitoring anomalies, playbooks, logs, incident data and similar past incidents. Azure describes searching incident history, saved facts and documents jointly. Neither settles a single ranking algorithm, so that remains your choice. A practical approach is two-stage:
- Recall candidates. Combine semantic similarity with hard signals: matching error signatures, the same affected resource, the same dependency. Pure embedding similarity will happily return an incident that reads alike but failed for a different reason.
- Check applicability. For each candidate, compare service identity, deployment or version, configuration, time and dependency context against the live incident. Record what matched and what differs.
- Rank by verified match, not by text closeness, and let the agent say “no good precedent” when nothing passes.
Microsoft’s FLASH authors put the risk plainly: “The challenge lies in how to efficiently gather this information and apply the knowledge using an automation tool with minimal human effort, as incorrect usage of the information might not only fail to improve accuracy but could also be detrimental.” A wrongly matched precedent is worse than none, because it carries unearned authority.
How the agent should present a precedent
Google describes the agent’s output as a credible lead plus next steps for verification. That framing is worth copying. A good response cites the old episode and gives the responder something to check:
- “A similar incident (link) showed pool-exhaustion errors after a release. Matches: same service, same error signature. Differs: that incident ran a different release line.”
- “Restarting the pods gave only temporary relief then. Before repeating it, check whether slow-query logs show connections being held.”
- “Raising the pool size mitigated that incident but shifted load to the database; confidence in root cause was medium.”
What the agent should not do is say “this worked last time, do it again” or “this failed once, avoid it”. Each statement should point to the source incident so the human can read the evidence.
Keeping memory trustworthy over time
- Provenance on every lesson. Microsoft documents links from session insights back to their originating threads; the same principle applies here. A lesson without a link cannot be audited.
- Review on a schedule. Azure warns that outdated documents cause incorrect responses and recommends reviewing its knowledge base quarterly. AWS likewise recommends periodic audits and that post-incident reviews lead to practical, maintained changes. Quarterly is Azure’s suggestion for its own knowledge base; choose a cadence that fits how fast your systems change.
- Correction, expiry and deletion. When a service is rewritten or a dependency retired, episodes tied to the old design should be flagged or aged out rather than left to compete with current knowledge.
- Retention and access. The sources reviewed do not establish one correct retention period or access-control model. Incident records can contain customer data, credentials in logs and internal hostnames, so define and document your own policy.
These practices support trust; they do not guarantee that a stored lesson is correct.
Free tools Windows power users keep installed
One-click scans. No signup required.
Evaluate it on the cases that go wrong
Google describes storing execution traces and comparing the agent’s actions with ideal human responses, and the FLASH paper presents supervision and reflection mechanisms for recurring diagnosis. Both point to evaluation as a first-class part of the design. Build a reviewed set of past incidents and score:
- Did retrieval surface the relevant precedent, and rank it above look-alikes?
- Did the agent keep success and failure distinct, including “outcome unclear”?
- Was each recommendation grounded in current evidence rather than the old record alone?
- Did it escalate when evidence was weak?
Include adversarial cases deliberately: a near-duplicate incident with a different cause, a stale record contradicting a current runbook, and a misleading hindsight note. Testing only the demos where memory helps tells you little.
Recommendation-only or acting: where to draw the line
For consequential changes, keep an operator approval step unless you have explicit safeguards and validated authority for automation. Google’s SRE guidance describes the boundary this way: “If AI Operator cannot identify the root cause, or if the scenario falls outside its safe operating boundaries, it immediately escalates to a human operator.” Nothing in the sources says autonomous remediation is generally safe or required.
| Dimension | Recommendation-only | Tool-enabled with approval | Autonomous action |
|---|---|---|---|
| Operator control | Full; agent changes nothing | Human approves each change | Limited to preset boundaries |
| Evidence visibility | Cited precedent and verification steps | Same, plus the exact action proposed | Needs full audit trail of what was done and why |
| Validation | Human checks the suggestion | Human checks, then verifies result | Must be proven on a reviewed incident set first |
| Rollback | Not applicable | Defined per action | Required and tested before enabling |
| Escalation | Agent says when it has no lead | Agent stops and asks | Must escalate automatically outside safe limits |
Start in the first column. Move right only for specific, well-understood actions, once evaluation shows the agent handles wrong-precedent and stale-memory cases correctly.
What a result can and cannot tell you
Google reports a 10% reduction in Mean Time to Mitigate from informational assistance by its own Incident Hypothesis system. The year is not stated on the guidance page, and the figure comes from Google’s scale and its ability to A/B test SRE practices. It shows that historical and contextual assistance can be measured; it is not an expected gain for a memory agent you build, and memory alone is not shown to improve every incident response. Measure your own MTTM before and after, and do so against a baseline that includes the same on-call team using existing tools.
Pitfalls checklist
- Treating a fix that preceded recovery as the cause of recovery.
- Turning one failed attempt into a global “never do this” rule.
- Retrieving incidents that sound alike but differ in service, deployment, configuration or failure mechanism.
- Storing lessons without source links, confidence or supporting evidence.
- Letting old memory override current monitoring or runbook guidance.
- Evaluating only successful demonstrations.
These are design cautions drawn from the guidance above, not documented failures of any specific product.
Optional background reading
For foundations rather than agent design, Google’s Site Reliability Engineering book includes chapters titled “Effective Troubleshooting,” “Emergency Response,” “Managing Incidents” and “Postmortem Culture: Learning from Failure,” all directly relevant to what an incident memory should capture.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
