Overview
Trending Incident Detection continuously groups your incoming support conversations into topics and watches each topic for an unusual jump in volume. When a topic spikes, IrisAgent surfaces it as a trending incident on the dashboard and can alert your team over email and Slack. The goal is to move from a reactive model, where an outage or regression is noticed only after tickets pile up, to a proactive one where the support team sees the pattern within minutes and can respond, message affected customers, and loop in engineering early. No manual configuration is required to start seeing topics and spikes. Topic clustering is on by default for cases and chat. Alerting is turned on by IrisAgent for your account.How detection works
1. Topic clustering
IrisAgent reads recent tickets and chat conversations and uses an LLM to group them into meaningful, feature or issue specific clusters (for example “Invoice PDF fails to download” or “SSO redirect to blank page”). Each cluster gets a title, a short description, and the list of matching conversations. The model is instructed to reuse an existing cluster when a new conversation fits one, so a topic stays stable over time. It is also instructed not to create generic, marketing, spam, or “low information” buckets, and a secondary filter drops automated or notification only streams that slip through. Clusters are stored in a per customer topic registry. Both support cases and website or in app chat are clustered.2. Baseline learning
For every topic, IrisAgent computes a rolling 30 day baseline: the median and the maximum number of conversations per day. The baseline is zero filled, meaning days where the topic had no conversations count as zero, so the baseline reflects the topic’s true typical volume rather than only its busy days. The baseline is refreshed daily.3. Spike scoring
IrisAgent scores each topic against its baseline on two cadences:- Daily. A preparation job scores every whole calendar day. This is the backstop and always runs when clustering is enabled.
- Real time. When real time detection is enabled for your account, a job runs every minute and scores the current UTC day so far. This is what catches a fast moving incident within minutes.
4. Spike confirmation
A topic is confirmed as a spike only when it clears these rules:
Topics on your exclusion denylist are dropped at this stage and never become a trending incident.
When more topics spike on the same run than the per run cap (default 15), IrisAgent keeps the ones with the largest percentage increase over baseline.
5. Incident lifecycle
A confirmed spike becomes an active trending incident. It carries the topic title, the description, the conversation count, the first spiked time, and sample affected conversations. When a later detection run no longer sees the topic spiking, the incident is marked resolved. The daily job backstops resolution for topics that were only ever caught in real time.Where trending incidents appear
- Categories / Category Insights on the IrisAgent dashboard. Spiking topics are marked as trending, with the volume trend and a link into the topic’s detailed view.
- Topic detailed view, which lists the affected conversations with links back into your ticketing system.
- Weekly briefing and weekly digest email, which call out the week’s new and trending topics and suggest investigating them.
Alerts and notifications
When alerting is enabled for your account, IrisAgent sends a “New and trending issue categories” notification that lists new topics and trending topics together, each with the conversation count, first seen time, and up to five sample conversation links.
To avoid repeat noise, a given trending incident is alerted at most once every 24 hours. Topics on your exclusion denylist are suppressed from alerts as well as from detection.
Configuration options
These settings live on your account’s category cluster configuration and are managed by IrisAgent. Contact contact@irisagent.com to change them.What you can do with a trending incident
- Open the topic’s detailed view to see every affected conversation and jump into your ticketing system.
- Ask Support Analyst about the topic to get a timeline, sentiment, and the affected accounts.
- Use AutoKB and procedures to give agents and the AI a correct answer while the incident is live.
- Track the volume trend on the Categories page to confirm the incident has resolved.
Notes
- Detection only sees conversations that were successfully clustered into a topic. A burst that lands entirely in unclustered conversations will not surface as a trending topic until clustering catches up.
- Real time scoring is anchored to midnight UTC. A burst that straddles midnight is split across two days and confirmed on the second day, with the daily job as the backstop.
- Both the daily baseline and the spike rules are per topic and per customer. One customer’s noisy topic never affects another’s detection.