Blind
Web-based assistants cannot reach live logs or private codebases.
Back to Projects
I.R.I.S. — IT Incident Assistant
Incident Response & Intelligence System
My team and I built an autonomous multi-agent system to support IT incident analysis, root-cause investigation, and post-incident documentation.
Problem
Incident Context Lives in Too Many Places
Logs, private codebases, prior incident reports, chat history, and engineers' experience rarely sit in one place. Generic web AI cannot access that context, while isolated command-line agents make collaboration and knowledge sharing difficult. The result is slower root-cause analysis and repeated post-incident administration.
Isolated
CLI agents keep useful context inside individual sessions instead of the shared incident room.
Memoryless
Resolved cases disappear into chat history instead of improving the next investigation.
Proposed Solution
Four Capabilities That Close the Incident-Response Loop
01
Context-Aware RAG
Retrieve relevant past cases and conversation history before an investigation begins.
02
Autonomous Investigation
Follow evidence across logs and code to identify likely root causes.
03
Self-Correcting Verification
Separate report generation from source checking through a dedicated verifier.
04
Closed-Loop Knowledge
Return approved resolutions to the knowledge base for future incidents.
System Architecture
How I.R.I.S. Coordinates the Investigation
The investigation, verification, and knowledge-retention loop reconstructed from the CareerHack prototype.
Step 01
Incident Intake
A shared Slack war room keeps the investigation visible to the team.
Evidence
Logs · Private codebase · Past incidents · Chat history
Step 02
Solver
Reads evidence and retrieves relevant organizational context before proposing a root cause.
Step 03
Reporter
Structures the evidence into a formal incident report and a concise summary.
Step 04
Verifier
Checks every claim against source material and sends mismatches back to the Reporter.
Reporter / Verifier Loop
Step 05
Knowledge Loop
Approved reports return to the knowledge base as retrievable context for the next incident.
My Contribution
Implementation & Outcomes
From Slack Intake to Verified Knowledge Storage
Slack-First Collaboration
The n8n-orchestrated agents plug directly into Slack, so questions, investigation progress, and results stay visible to the team.
Evidence-Backed Reporting
Agents read logs and code through a FastAPI tool layer, and the Vertex AI-powered Reporter turns the findings into a formal PDF and a concise summary.
Verified Knowledge Retention
Approved reports are chunked, embedded with gemini-embedding-001, and stored in pgvector on PostgreSQL, with source-level dedup to reduce duplicate content in retrieval.
- TSMC IT CareerHack
- Champion
- Built by a four-person team
- Projected MTTR Reduction
- 40%
- Hackathon business estimate
- Unified in One Investigation
- 4 Sources
- Logs, code, past incidents, and chat history
Limitations
What Remains to Be Validated
I.R.I.S. was a hackathon prototype, so the 40% MTTR reduction is a projected business estimate rather than a production measurement. Real deployment would still require permission design for private logs and code, evaluation on representative incidents, and ongoing governance of knowledge quality.