🚨 Sentinel AI

Inspiration

Production incidents are stressful, time-sensitive, and often require engineers to switch between multiple tools to investigate issues, coordinate teammates, and document findings. We wanted to simplify this process by bringing AI-powered incident management directly into Slack, where engineering teams already collaborate.

The goal was to build an intelligent Slack agent that acts as an Incident Commander, helping teams detect incidents, guide investigations, maintain timelines, and generate postmortems—all without leaving Slack.

What it does

Sentinel AI is an AI-powered Slack agent that automates the incident response lifecycle.

When a user reports an issue by mentioning the bot, Sentinel AI uses a Large Language Model (Groq Llama 3.3 70B) to determine whether the message describes a production incident. If an incident is detected, it identifies the affected service, classifies its severity, and presents an interactive Slack workflow.

The agent guides responders through a structured investigation by collecting information about the affected environment, recent deployments, and customer impact. Throughout the investigation, Sentinel AI maintains an incident timeline and generates an AI-powered investigation summary.

Once the investigation is complete, the incident can be resolved directly within Slack, after which Sentinel AI automatically generates a comprehensive postmortem including the executive summary, root cause analysis, business impact, lessons learned, and action items.

How we built it

Sentinel AI was built using:

Node.js
Slack Bolt SDK
Slack Block Kit
Groq API (Llama 3.3 70B)
JavaScript
Render for deployment
GitHub for version control

The application listens for Slack Events, analyzes incident reports using AI, stores incident state in memory, and drives interactive workflows using Slack buttons and Block Kit components.

Challenges we ran into

Building Sentinel AI involved several technical challenges.

One of the biggest challenges was configuring Slack Events, Interactivity, OAuth permissions, and deploying the application correctly on Render. Ensuring Slack could communicate securely with our hosted application required careful configuration of request URLs, environment variables, and event subscriptions.

Designing reliable AI prompts for incident detection was another challenge. We refined the prompts to improve the consistency of incident classification while minimizing false positives.

We also designed a guided investigation workflow that feels natural inside Slack while maintaining the state of each incident across multiple user interactions.