Investigate incidents

kya investigate reads the local trail and runs deterministic detectors over it. No network, no model calls: the same trail gives the same findings every run.

kya investigate           # summary: counts by severity + top incidents
kya investigate --json    # findings + incidents + briefs, machine-readable

What it looks for

• PII leaks in event summaries
• DENY spikes
• Approval retry loops
• Repeated never-event attempts
• Unknown tools under hold
• Slow tools

Findings group into incidents, and each incident renders a markdown fix brief shaped to paste into Claude Code, Cursor, or Codex so the coding agent applies the fix with full context.

Hosted incidents

The hosted console runs the same six detectors against your hosted trail: /app/kya/incidents lists incidents with severity, evidence, and fix briefs, and POST /api/v1/kya/investigate/run triggers a manual scan. Scan cadence follows the plan: Free runs manually over a 7-day window (1 run per hour), Starter scans daily over 30 days, Pro and Scale hourly over 90 days. Fix briefs render Starter and up. On Pro and Scale, a new critical or high incident also fires a kya.incident.opened webhook to your registered endpoints with backoff retry.