Key concepts

​

Moose Builder

The Moose Builder is your primary interface for working with Wild Moose. It’s an AI agent that guides you through creating, testing, and refining debugging agents conversationally - no need to learn YAML or configuration syntax. Just describe what you want to investigate and the Builder handles the rest. Learn more.

​

Debugging agents

Wild Moose uses specialized debugging agents to investigate production incidents. Each agent is a focused investigator that knows how to query your observability tools, analyze the results, and surface root cause analysis - in seconds. An orchestrator dynamically selects and coordinates agents based on the alert context. Multiple agents can run in parallel, each investigating a different angle. Each agent’s playbook contains:

• Monitor patterns - alert patterns that trigger the agent automatically.
• Required attributes - parameters like environment, cluster, or host that scope the investigation.
• Actions - the individual steps the agent runs during the investigation.
• Mitigation tools - remediation steps surfaced after the investigation completes.

Agents are lightweight, cost-effective, and scalable - designed to run on every alert, not just critical ones.

​

Actions

Actions are the individual steps inside an agent’s playbook. Each action queries one of your connected tools to gather a specific piece of evidence. Examples of actions:

• Query CPU and memory metrics from Datadog
• Search application logs for error patterns
• Check recent deployments in your CI/CD system
• Look up traces for slow endpoints

Actions run in parallel when possible, so investigations complete in seconds.

​

Enrichments

An enrichment is the output of a completed investigation - a structured summary posted back as a threaded reply on the original alert. An enrichment typically includes:

• Root cause analysis - an AI-generated summary of what went wrong and why.
• Key findings - highlights from each action that ran (e.g., “CPU at 95% on web-server-01”).
• Links - direct links to the relevant dashboards, log queries, or traces in your observability tools.
• Suggested mitigations - actionable next steps to resolve the issue.

​

Feedback

Wild Moose gets smarter with every incident. After an investigation completes, your team can provide feedback on the results - flagging what was useful, what was missing, or what could be improved. This feedback feeds directly into the system, helping agents refine their investigations over time and adapt to your team’s specific environment and workflows.

​

Alert matching

When an alert arrives in a monitored channel, the orchestrator analyzes the alert context and dynamically coordinates the right debugging agents. The system can match alerts based on multiple signals and run multiple agents in parallel to investigate different angles simultaneously. If a match is found, Wild Moose automatically kicks off the investigation. Investigations can also be triggered programmatically via the Execution API.