DOCUMENTATION / v1

ResolveIQ Documentation

Evidence-first incident analysis and human-controlled runbook generation for IT and infrastructure teams.

01 / OVERVIEW

Make the next investigation more defensible.

ResolveIQ accepts an incident, retrieves bounded fictional historical evidence and curated runbooks using deterministic scoring, and asks Amazon Bedrock for structured diagnostic guidance. The interface separates current facts, retrieved evidence, AI inference, recommended checks, uncertainty, and reusable knowledge.

02 / ARCHITECTURE

Serverless AWS by design.

The browser loads from an Amazon S3 static website. API Gateway routes requests to AWS Lambda, which persists records in DynamoDB and invokes Amazon Bedrock. CloudWatch provides runtime logs.

Browser → S3 → API Gateway → Lambda
　　　　　　　　 ↙　　　　　 ↘
　　　　　 DynamoDB　　 Amazon Bedrock
　　　　　　　　 ↓
　　　　　　CloudWatch

03 / INCIDENT ANALYSIS

Capture → retrieve → reason → validate.

The analysis flow validates the submitted incident, persists it, retrieves up to five relevant historical incidents and three curated runbooks, invokes Bedrock with bounded context, validates the structured response and its evidence references, then returns the analysis.

04 / EVIDENCE MODEL

Every output has a clear role.

Human Facts
Information directly supplied by the responder.
Historical Evidence
Fictional records retrieved by deterministic application logic.
AI Inference
Possible causes suggested from the available context; never a confirmed root cause.
Recommended Checks
Diagnostic actions for a human engineer to perform.
Uncertainty
Explicit limitations and missing context that affect confidence.

05 / RUNBOOK GENERATION

Preserve what worked.

After an incident is resolved, a human-approved resolution can be submitted to generate a structured reusable runbook. The exact resolution is preserved, the runbook is validated, and it is persisted for future operational knowledge.

06 / API REFERENCE

Two focused endpoints.

POST /incidents/analyze

Validate, persist, retrieve evidence, invoke Bedrock, validate the analysis, and return incident results.

POST /incidents/{incidentId}/runbook

Generate and persist a reusable runbook from a submitted human-approved resolution.

07 / DEPLOYMENT

Repeatable infrastructure.

The backend is deployed with AWS SAM and CloudFormation. The frontend is a framework-free static site that can be served locally or uploaded to an S3 static website. See the repository README for the project’s current commands.

08 / SECURITY

Human control stays in the loop.

  • No production changes are performed automatically.
  • Demo data is fictional or anonymized; no real customer or ServiceNow data is used.
  • Resolutions remain human-controlled and require human approval.
  • Input, model output, and evidence references are validated server-side.
  • Credentials and secrets are not committed to source.

09 / LIMITATIONS

Know the boundaries.

  • Historical data is fictional for the demonstration.
  • AI output can be incorrect and hypotheses require human verification.
  • The system does not automatically remediate production systems.
  • Retrieval is deterministic and is not an embedding or vector search system.

10 / CONTRIBUTING

Build in the open.

Clone the repository, follow the local development and testing commands in the README, and submit focused improvements that preserve the evidence-first model and existing API contracts.

View repository ↗