Trending Incident Detection

Group support conversations into topics, detect volume spikes in real time, and alert your team before an incident escalates

IrisAgent groups incoming tickets and chats into topics and watches each topic for an unusual jump in volume. When a topic spikes, it shows up as a trending incident on the dashboard, and IrisAgent can alert your team by email and Slack.

Topic clustering is on by default for cases and chat. IrisAgent turns on alerting for your account.

​

How detection works

1. Clustering. An LLM groups recent tickets and chats into specific topics (for example, “Invoice PDF fails to download”), each with a title, description, and matching conversations. New conversations reuse existing topics where they fit. Generic, marketing, spam, and automated notification streams are filtered out.

2. Baseline. For each topic, IrisAgent computes a rolling 30-day median and maximum of conversations per day. Days with no conversations count as zero. The baseline refreshes daily.

3. Scoring. A daily job scores each full calendar day. If real-time detection is on, a job also runs every minute on the current UTC day so far.

4. Confirmation. A topic becomes a spike only if it meets one of these rules:

   Topic	Rule
   Older than 4 days	At least the absolute floor (default 8 conversations) and at least the threshold times the baseline median (default 5x).
   Older than 4 days, busy	Sets a new 30-day high and is at least 3x the baseline median.
   4 days old or newer	At least the new cluster floor (default 12 conversations).

   Topics on your exclusion list are dropped. If more topics spike in one run than the cap (default 15), IrisAgent keeps the ones with the largest percentage increase.

5. Lifecycle. A confirmed spike becomes an active trending incident with the topic title, description, conversation count, first spiked time, and sample conversations. When a later run no longer sees the spike, it is marked resolved.

​

Where you see them

• Analytics → Topics marks spiking topics as trending, with the volume trend and a link to the topic’s detailed view.
• The topic detailed view lists affected conversations with links to your ticketing system.
• The weekly briefing and digest email call out new and trending topics.

​

Alerts

When alerting is on, IrisAgent sends a notification listing new and trending topics, each with the conversation count, first seen time, and up to five sample conversation links.

Channel	Detail
Email	Sent to users set up to receive category notifications. Cadence: real time, daily, weekly, or monthly.
Slack	Posted to your connected Slack channel with a button to the topic. Best effort; it never blocks the email.

Each trending incident alerts at most once every 24 hours. Excluded topics never alert.

​

Settings

IrisAgent manages these settings. Email [e-mail] to change them.

Setting	Default	What it controls
Topic clustering (cases)	On	Cluster support cases into topics.
Topic clustering (chat)	On	Cluster website and in-app chats into topics.
Real time detection	Off unless enabled	Run spike detection every minute on the current day.
Batch notifications	Off unless enabled	Daily, weekly, or monthly new and trending topic emails and Slack posts.
Real time notifications	Off unless enabled	Alert as soon as a real-time spike is confirmed.
Daily threshold	5x	Multiple over baseline median for the daily job.
Real time threshold	5x	Multiple over baseline median for the real-time job.
Absolute volume floor	8	Minimum spike-day conversations for a mature topic.
New cluster floor	12	Minimum spike-day conversations for a topic too new to have a baseline.
Max spikes per run	15	Cap on trending incidents per run, ranked by percentage increase.
Excluded categories	Empty	Topic titles that must never trend or alert.

​

Act on a trending incident

• Open the topic’s detailed view to see every affected conversation.
• Ask Support Analyst for a timeline, sentiment, and affected accounts.
• Use AutoKB and procedures to give agents and the AI a correct answer while the incident is live.
• Watch the volume trend on the Topics page to confirm it has resolved.

​

Limits

• Only conversations that were clustered into a topic count toward a spike.
• Real-time scoring resets at midnight UTC. A burst that crosses midnight is confirmed on the second day, with the daily job as backup.
• Baselines and rules are per topic and per customer. Other customers never affect your detection.