Giving AI Agents Operational Memory: Connecting incident.io to Cognee

Modern software reliability hinges on incident response. During a critical outage, engineers jump into channels, declare an incident, mitigate root causes, and record post-mortems and remediation items.

Tools like incident.io have become the gold standard for tracking this lifecycle. But what happens after the incident is resolved?

In most organizations, that vital operational wisdom is siloed. When an on-call engineer or an autonomous AI agent encounters a similar timeout, degraded cluster, or memory leak weeks later, it has zero contextual memory of the past outage.

In this post, we explore how building a dedicated data-source connector for Cognee bridges this gap, feeding real-time incident data into an AI agent memory graph.

---

What is Cognee?

Cognee is an open source memory and knowledge-graph layer for AI agents. Rather than dumping unstructured text into naive vector stores, Cognee processes raw enterprise documents, extracts entities and relationships, and indexes them into a unified knowledge graph.

With three asynchronous calls:

await cognee.add(source)
await cognee.cognify()
results = await cognee.search("What caused the recent billing outage?")

agents can recall complex relationships across different tools.

---

Why Connect incident.io?

When an outage strikes, incident.io records:

1. Incident Attributes: Severity (Critical, Major), lead responders, components affected, and executive summaries.
2. Chronological Timelines: Real-time updates with timestamps capturing investigative milestones.
3. Action Items: Follow-up tasks with assignees and completion states.

By ingesting this into Cognee, engineering teams and AI assistants can answer operational queries like:

• "Who was the lead responder on the last database connection pool exhaustion?"
• "What remediation actions were decided after our Cloudflare 502 outage?"
• "Are there recurring outage patterns affecting our payments service?"

---

Technical Architecture & Ingestion Flow

The incident_io connector lives in cognee-community/packages/connector/incident_io/.

1. Document Mode Routing

Instead of pushing raw tabular database rows, the connector tags its dlt source with:

setattr(source, DOCUMENT_SOURCE_ATTR, "incident_io")

This signals Cognee's ingestion pipeline (resolve_dlt_sources) to treat each incident as a rich Markdown prose document, passing it directly through LLM entity extraction and knowledge-graph linking.

2. Markdown Synthesis

Each incident is flattened into structured, human-readable markdown with clear headings:

# Incident: Database Connection Pool Exhaustion

- **Status:** resolved
- **Severity:** Major
- **Lead:** Alex Mercer
- **Opened:** 2026-10-10T14:00:00Z
- **Resolved:** 2026-10-10T14:45:00Z

## Summary
Primary Postgres pool was saturated causing 504 Gateway Timeouts.

## Timeline & Milestone Updates
- **[2026-10-10T14:05:00Z]** Investigating high latency on api-gateway.
- **[2026-10-10T14:40:00Z]** Increased max connections in PgBouncer; service stabilized.

## Remediation & Follow-up Actions
- [x] Add alert threshold for PgBouncer pool saturation (Assignee: DevOps OnCall)
- [ ] Perform query audit on long-running analytics jobs (Assignee: Data Team)

3. Full Snapshot & Forget-on-Delete

Using write_disposition="replace", Cognee maintains an exact mirror of current incidents. If an incident or draft report is permanently deleted or expunged in incident.io, it naturally drops out of the active snapshot and Cognee's orphan_cleanup purges the corresponding nodes from both graph and vector storage.

---

Quickstart

import asyncio
import cognee
from cognee_community_connector_incident_io import incident_io_source

async def main():
    # Ingest incident.io data
    source = incident_io_source()
    await cognee.add(source)

    # Build the knowledge graph
    await cognee.cognify()

    # Search past incident memory
    answers = await cognee.search("How did we resolve the pool saturation issue?")
    for ans in answers:
        print(ans)

if __name__ == "__main__":
    asyncio.run(main())

---

Conclusion

Operational intelligence is one of the most valuable forms of company knowledge. Connecting incident.io to Cognee transforms static post-mortems into an active, queryable memory graph that empowers both developers and AI agents to resolve outages faster.