AI in FireFight
Firefight’s AI features turn what your team and your systems already know into answers during an incident, and into a written record after it. They run where you already work, in Slack and in the dashboard, and they work from Firefight’s own data and the tools you connect.
The features
Section titled “The features”| Feature | Where | What it does |
|---|---|---|
| Halon | Chat in the dashboard, mentions and direct messages in Slack, MCP | Firefight’s AI SRE. Answers questions, looks things up in your connected tools and does work in Firefight for you |
| Investigations | /ff investigate, the incident’s pinned message, a chat, MCP | Halon works out why something broke, shows every step, and proposes a fix you can apply |
| Halon on call | Halon → On-call in the dashboard | Halon looks at an alert the moment it opens an incident, pages whoever is on call with what it found, and makes the changes your team allowed ahead |
| Monitoring and security | Halon → Monitoring in the dashboard | Runs checks on a schedule you set, says each slow problem once in the owning team’s channel, and looks into leaked secrets as they are reported |
| Pull request review | A comment or reviewer request on GitHub, GitLab or Bitbucket, or Halon → Pull requests to review every pull request | Reviews a pull request against your incidents, the map and your team’s lessons, and checks each fix you push |
| Workflows | Halon → Workflows in the dashboard, or by asking Halon | Runs a set of steps on a schedule, when something happens, or when someone presses Run |
| Skills | Halon → Skills in the dashboard | Recipes Halon follows for a task, Firefight’s own and the ones your team writes |
| Summaries & catch-up | /ff catchup in an incident channel | Posts a concise summary of what has been investigated, decided and blocked, for responders joining late |
| Live summary | Behind the scenes | A summary of the channel’s conversation, kept current as it moves, which catch-ups and postmortem drafts build on |
| Timeline notes | Automatic, once an incident ends | Reads the channel and adds the milestones of the investigation to the incident’s timeline, each linked to the message it came from |
| Postmortem drafting | /ff postmortem or the incident’s page in the dashboard | Generates a structured postmortem draft from the timeline and the channel’s conversation |
| Section rewrite | The postmortem editor | Rewrites a selected passage of the postmortem according to your instruction |
Halon is the AI you talk to. Ask it on the Chat page under Halon in the dashboard’s sidebar, mention @Firefight in an active incident’s channel, or send Firefight a direct message in Slack, and it does the work the question needs before it answers. It reads Firefight’s records and your connected tools, and in a chat it acts as you, with your permissions.
| Page | What it covers |
|---|---|
| Halon | What Halon is, where you meet it, what it works from and what it leaves to you |
| Chatting with Halon | The Chat page, mentions and direct messages in Slack |
| Investigations | Asking Halon to find out why something broke, and applying or undoing its fix |
| What Halon can do | The tools it uses through your integrations, and when it asks first |
| Changes without asking | Which changes run without asking, and the list of risky changes Halon may make without asking |
| Halon’s plans | The checklist Halon keeps for a request of more than one step |
| Halon watching for you | Having Halon follow a run, a deploy or a reading and report back |
| Helpers | Independent reads Halon hands to helpers that run at the same time |
| Halon’s safe changes | The safeguards around changes to data, temporary changes and stopping someone else’s work |
| What changed and provider status | What changed around a service, outside providers’ status pages, and systems nothing connects |
| Reading your platforms | The general read Halon has of each connected platform’s API |
| Instructions for Halon | Telling Halon how to work for the workspace, a team, a service or a resource |
| Halon’s memory | What Halon remembers about your setup, and how it checks each memory against production every night |
| Pull request review | Halon’s reviews of pull requests, the lessons they check and the strict check |
| The handbook | Pages your team writes that Halon reads first |
| Giving Halon a file | Attaching screenshots, PDFs and logs to a question |
| How Halon has done | How Halon’s answers and fixes have held up |
The AI behind it
Section titled “The AI behind it”Halon needs an AI model for everything it writes. On Firefight’s cloud it can run on Firefight’s own AI, with an amount included every month and more you can add, or on your own key with a model provider. On a Firefight you run yourself it uses the AI keys the server is set up with, or your own key. Your own keys always come first. See AI accounts.
Chats and investigations run on the main model, Claude Sonnet 5.5 unless you pick another, and quick side jobs such as summaries run on a cheaper quick model, Claude Haiku 5.5 where the provider runs it. When the main model stops answering, Halon carries on with a backup and says so. See AI models.
When Halon asks before acting
Section titled “When Halon asks before acting”Halon reads without asking. A safe change, such as assigning someone to an issue or restarting a service that runs more than one copy, runs without asking and shows in the chat, and your admins can list risky changes Halon may make without asking. See Changes without asking. Before any other change, it asks on one card that starts “Halon wants to” and names the change, with Approve and Cancel, in the dashboard and in Slack. Approval rules your team set still apply on top. Text Halon read from outside Firefight, such as an issue, a log line or a web page, can be written to steer it, so once it has read any, a change on that list or one you allowed for the rest of the chat asks again, and the card lists what it read. See What Halon can do.
Catch-up and the live summary
Section titled “Catch-up and the live summary”The live summary tracks the conversational story of an incident, the theories tested, the decisions made and the open questions, and updates as new messages arrive. /ff catchup builds on it, so a catch-up stays fast even in a long incident. See Summaries & catch-up.
Timeline notes
Section titled “Timeline notes”When an incident is resolved or cancelled, Firefight reads its channel once and writes the genuine milestones onto the timeline, such as the theories, the findings, the root cause and the mitigation. Each note names who said it, sits at the time they said it, and links to the message. Nothing is posted to the channel, and a note that reads a conversation wrong can be dismissed. See Timeline notes.
Postmortems
Section titled “Postmortems”Once an incident is closed, Firefight can draft the postmortem for you. It is written from the timeline, including the notes above, so the reasoning chain arrives with its authors and times rather than being worked out a second time.
The draft is structured into sections covering the summary, impact, resolution, contributing factors, what went well, and action items, and it lands as an editable document, not a final verdict. Run /ff postmortem in the closed incident’s channel or generate from the incident’s page in the dashboard. Inside the editor, select any passage and tell the AI how to rewrite it, and it revises just that selection in place. You can also skip generation entirely and start from a blank document. See Generating with AI.
When a postmortem is marked completed, Halon reads it for anything new it should remember. See Halon’s memory.
What the AI sees
Section titled “What the AI sees”Every feature works from data Firefight holds or reaches through the tools you connect, and channel messages are scrubbed for known secret formats before they are ever stored. For the full picture of what is stored, what is redacted and what is sent to models, see AI data handling.