An alert fires; an incident opens; the logs from the 5 minutes before the fire are automatically attached. Timeline, ownership, status, comms — all in one place, all linked, all auditable.
The agent detects the crash and collects the five minutes before it, plus two minutes after. You read the cause, not the aftermath.
Alert fires, incident opens, logs attach, metrics snapshot at crash time. Nobody types any of that during an outage.
The dependency map shows what else sits behind the thing that failed, which is the part people underestimate.
Service and host state changes open an incident without anyone filing it.
Logs from before and after, filtered dmesg and the metrics at crash time are attached while they still exist.
Status workflow, comments and an impact graph of what depends on the thing that broke.
Incident management from Starter; Slack auto-channel from Pro.