Data Sources Overview

Connect IncidentFox to your observability stack

Overview

IncidentFox connects to your existing observability and data platforms to investigate incidents. This section covers how to configure each data source.

Supported Data Sources

Observability Platforms

Platform	Status	Capabilities
Coralogix	Supported	Log search, metrics, alerts, Olly integration
Datadog	Supported	Metrics, logs, APM traces
Grafana	Supported	Prometheus queries, dashboards, alerts
New Relic	Supported	NRQL queries, APM summary
Elasticsearch	Supported	Log search, aggregations

Cloud Providers

Platform	Status	Capabilities
AWS	Supported	CloudWatch, EC2, Lambda, RDS, ECS, CodePipeline
GCP	Roadmap	Cloud Logging, GKE, Cloud Run
Azure	Roadmap	Monitor, AKS, Functions

Infrastructure

Platform	Status	Capabilities
Kubernetes	Supported	Pod logs, events, deployments, metrics
Docker	Supported	Container logs, exec, compose

Data & CI/CD

Platform	Status	Capabilities
Snowflake	Supported	SQL queries, data enrichment
GitHub	Supported	Code search, PRs, Actions, webhooks
Confluence	Supported	Documentation search
Google Docs	Supported	Runbook search

Data Source Architecture

Credential Management

All credentials should be stored securely using vault references:

{
  "tools": {
    "coralogix": {
      "api_key": "vault://secrets/coralogix-api-key"
    }
  }
}

Never store credentials in plain text in configuration files.

Vault Reference Format

vault://path/to/secret

IncidentFox supports:

• AWS Secrets Manager
• HashiCorp Vault
• Environment variables (for development)

Quick Setup

1. Choose Your Data Sources

   Identify which platforms you want IncidentFox to access

2. Create API Keys

   Generate read-only API keys for each platform

3. Store in Vault

   Add credentials to your secrets manager

4. Configure in Web UI

   Add data source configuration in Team Console

5. Test Connection

   Verify IncidentFox can access each data source

Required Permissions

Each data source requires specific permissions. Generally, IncidentFox needs read-only access for investigation.

Data Source	Required Permissions
Coralogix	API key with read access
AWS	CloudWatch read, EC2 describe, RDS read
Kubernetes	Pod logs, events, describe resources
GitHub	Repo read, issues read, PRs read
Snowflake	SELECT on relevant tables
Datadog	API key + App key with read access

Principle of least privilege: Only grant permissions that are necessary for investigation. IncidentFox doesn’t need write access unless you enable auto-remediation.

Data Flow

When IncidentFox investigates an incident:

1. Agent determines which data sources are relevant
2. Tools are invoked to query each data source
3. Data is retrieved and processed locally
4. Results are correlated across sources
5. Findings are reported back to the user

Data is:

• Retrieved on-demand (not continuously polled)
• Processed in-memory (not stored long-term)
• Filtered by time range (typically last 1-24 hours)

Next Steps

Coralogix

Connect your Coralogix account

Snowflake

Set up data enrichment

AWS

Configure AWS access

Kubernetes

Connect to your clusters