Buddy Knowledge Base

The Knowledge Base is the layer that lets Buddy answer "has this happened before?" and "how was a similar incident resolved?" by searching across past alerts, Runbooks, and Postmortems. It is built automatically from resolved incidents — there is no separate "knowledge editor" to maintain.

What is in the Knowledge Base

Three sources feed Buddy's investigation search:

Source	Where it comes from
Past alerts	Every alert your Organization has received. Searched by similarity to the current alert.
Runbooks	Every published Runbook document (`doc_type = "runbook"`). Searched semantically and by keyword.
Postmortems	Every published Postmortem document (`doc_type = "postmortem"`). Searched semantically and by keyword.
Distilled knowledge	Recurring patterns extracted from many resolved incidents (see How distillation works).

Only published documents are searched. unpublished and archived documents are excluded so that Buddy never quotes a half-written or retired procedure to a responder.

How Buddy searches

Buddy chooses the right search tool based on what you asked for:

You ask Buddy about...	Buddy uses...
Similar past incidents or alerts	Semantic search across past alerts.
Known resolution patterns	Semantic search across distilled knowledge.
Past postmortems by topic	Semantic search across Postmortem documents.
Operational procedures	Semantic search across Runbook documents.
Exact error code or service name	Keyword search across alerts or Postmortems.
Alert frequency or trend	Alert frequency analysis.

In an incident room, Buddy automatically uses the open Bundle as the search context — you do not need to repeat what the incident is about. In a personal chat, Buddy uses the question you typed as the search query.

Investigation Hints

You can teach Buddy how to investigate without writing a Runbook. Free-text investigation hints are attached to three resources:

Team — investigation_hints on the Team. Applies to every incident on that Team's Schedules.
Schedule — investigation_hints on the Schedule. Applies to every incident on that Schedule.
MCP connection — investigation_hints per MCP server connection. Applies whenever that MCP's tools come into scope.

Hints are loaded into Buddy's prompt so it can follow your conventions ("check the deploy dashboard before paging the DB team", "this Schedule's owner is offline on weekends — escalate sooner").

See Team configuration, Schedule configuration, and MCP integrations for where each hint is edited.

How distillation works

After a Bundle is resolved, Buddy can write a short resolution summary capturing what happened and how it was fixed. These summaries are then grouped into recurring patterns by a background job and stored as distilled knowledge — so Buddy can later say "this looks like a known pattern" rather than just "here are five similar past alerts".

You do not need to manage distillation by hand:

Resolution summaries are written automatically when a Bundle closes (if AI features are enabled).
The distillation job runs on its own schedule and only produces new entries when there are enough similar incidents to be worth grouping.
Distilled knowledge is read-only from Buddy's point of view. The source of truth is still the underlying alerts and documents.

Proactive search in incident rooms

When you open an incident room, Buddy proactively pre-fetches a small set of likely-useful search results (similar alerts, similar Postmortems, related Runbooks) before you ask anything. This is what makes the first Buddy reply in an incident room arrive with citations instead of starting from scratch.

If a result is too old, irrelevant, or low-quality, Buddy is instructed to drop it rather than quote it. You can also ask Buddy to redo a search with a more specific query.

AI feature toggles

Knowledge Base search runs under the knowledge_base AI feature. See Organization settings for ai_settings.features.knowledge_base.enabled. Disabling it removes the search tools from Buddy's tool list; Buddy can still chat, but it will not retrieve past incidents or distilled knowledge.

Examples

A new responder asks an open question in an incident room:

The Bundle is open and Buddy is loaded with the alert context.
The responder asks: "Has this happened before?"
Buddy returns similar past alerts and any related Postmortems, with links to each so the responder can read them in one click.

A team lead investigates a recurring class of alerts:

From a personal chat, the lead asks: "Summarize what we know about disk-full alerts on the db tier."
Buddy searches distilled knowledge and pulls the most recent matching Postmortems.
Buddy proposes a short summary with citations. The lead can then ask Buddy to draft a new Runbook from it (see Buddy Runbook generation).

Buddy AI chat — chat session, tools, and approval flow.
Buddy Runbook generation — how Runbooks are drafted from search results.
Buddy Postmortem generation — how Postmortems feed the Knowledge Base.
Document management — only published documents are searched.
Team configuration, Schedule configuration, MCP integrations — where investigation_hints are edited.
Organization settings — knowledge_base toggle.