Sync OrionIQ docs with 3 months of API and product changes

[galangel]

OrionIQ docs sync over 3 months of commit history (2026-05-27 → 2026-08-27) across Artemis, OIQ-AI-service, and gaia-hermes-ws. oiq-resources was read at HEAD as the source of truth for catalog data (integration categories, auth methods, marketplace templates), not scanned for history.

Public API endpoints documented (/v2, x-api-token)

• POST /v2/ai-agent/:agentId — run an agent
• GET /v2/ai-agent/:agentId/:sessionId — poll run status
• POST /v2/ai-agent/:agentId/:sessionId — follow-up
• POST /v2/ai-agent/:agentId/enable · /disable
• POST /v2/ai-agent/:agentId/feedback — new comment field (ORIONIQ-1011)
• GET /v2/ai-agent/:agentId/feedback/:sessionId — new (ORIONIQ-1011)

Lessons (GET .../lessons, PUT .../lessons/:lessonId/status) are live in public.routes.ts but have no UI in the product, so they're not documented — recorded in agents.md to document when the UI lands.

Doc paths

Path	Change
docs/user-guide/orioniq/api.md	New — API reference
docs/user-guide/orioniq/memory.md	New — Memory (ORIONIQ-885, ORIONIQ-1371, ORIONIQ-1530)
docs/user-guide/orioniq/settings.md	New — User / Account / Capping / Logz.io (ORIONIQ-805, APPZ-2147)
docs/user-guide/orioniq/integrations.md	Renamed from utilities.md; real 16 categories and auth methods from oiq-resources; Catalog + Management tabs; Logz.io API scopes (ORIONIQ-1222)
docs/user-guide/orioniq/agents-hub.md	Triggers menu, row actions, Updated By, Created By / Activation filters, run outcomes, read-only scope; capping now links to the Settings page (ORIONIQ-1524, ORIONIQ-1527, ORIONIQ-601, ORIONIQ-1091, ORIONIQ-1182)
docs/user-guide/orioniq/create-agent.md	All seven editor sections
docs/user-guide/orioniq/usage-performance.md	AI Agents / AI Chat tabs, Agent Type + Total Cost, Unknown Agent (ORIONIQ-1065, ORIONIQ-1253)
docs/user-guide/orioniq/index.md	Integrations rename; Memory, Settings, API entries
docs/open360/settings/ai-settings.md	Correction — ORIONIQ-1561 replaced the limit inputs with a link out; now points straight at Settings → Capping
docs/open360/alerts/configure-alerts-explore.md + docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md	Correction — the Slack-notification-endpoint requirement is obsolete since ORIONIQ-1298; recipients section added to the user-guide copy, which had drifted
docs/user-guide/cloud-siem/security-rules/manage-security-rules.md	New Alert AI Analysis section — SIEM rules use the same stepper as alerts and had no docs
static/_redirects	utilities/ → integrations/
agents.md	New — bot operational memory

yarn build passes (onBrokenLinks: 'throw'); all cross-page anchors verified in the build output.

Still not documented — recorded in agents.md:

• OrionIQ chat (rename, Fast/Advanced chat modes, history, stopping a run, legacy AI Assistant history) — needs a decision on which surface the docs describe, the Open 360 drawer or the standalone app.
• OrionIQ for SIEM (ORIONIQ-622: scannable-account agent visibility, SIEM workspace access) — separate from the Alert AI Analysis section added here.
• Mobile push notifications for finished runs (ORIONIQ-1463/1464).
• Agent audit log provenance columns (ORIONIQ-1531) — unclear whether it's customer-visible.
• User journeys (in-product tours, ORIONIQ-1432) — probably don't need docs.
• The duplicate Observability IQ category — see the comment thread; it's a migration, not a cleanup.

[netlify]

✅ Deploy Preview for deluxe-empanada-3ebf3b ready!

Name	Link
🔨 Latest commit	3d55bcd
🔍 Latest deploy log	https://app.netlify.com/projects/deluxe-empanada-3ebf3b/deploys/6a907880184e2f00086f21c8
😎 Deploy Preview	https://deploy-preview-960--deluxe-empanada-3ebf3b.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[galangel]

All 13 review comments addressed and pushed in c529e1b — replied on each thread with what changed.

Two items from the separate feedback:

1. The pages that were missed — done in this push.

• configure-alerts-explore.md (both copies): the :::note requiring a Slack notification endpoint was obsolete. ORIONIQ-1298 moved RCA v2 off the per-alert hidden endpoint, and the page already contradicted itself lower down ("By default the analysis goes to the same recipients as the alert itself"). The note is now about giving the alert a clear description, and recipients point at the existing section. The user-guide copy was also missing the Recipients and Runbook and instructions subsections the open360 copy has — the twins had drifted, so I aligned them.
• manage-security-rules.md: had no AI content at all. SIEM rules render the same AIAgentRCA stepper as alerts (modelName="rule"), so there's now an Alert AI Analysis section covering recipients, runbook, and the per-rule daily cap.

2. The duplicate Observability IQ category — not done, and I'd like your call first.

docs/open360/observability/ and docs/user-guide/observability/ are the same three pages twice (assistantiq.md, ai-agent-analysis.md, faq.md), which is why the category renders at both /docs/category/observability-iq/ and /docs/category/observability-iq-1/. You're right that they duplicate each other and overlap the OrionIQ pages.

I didn't delete them because it isn't a cleanup:

• 20 inbound links across 14+ pages point into them — from Explore, K8s 360, App 360/APM, PagerDuty, account-region, release notes, and both alerts pages. With onBrokenLinks: 'throw' every one has to be repointed or the build fails.
• They're live public URLs, so removal needs static/_redirects entries, and the AI Agent / AI Agent Analysis content has no home in the OrionIQ section today — the chat surface isn't documented there yet (that's the open gap in agents.md).

So it's a migration with a decision behind it: which tree survives, and where the AI Agent chat content lands. Happy to do it as a follow-up PR once you say which way — the mechanical part (repoint links, add redirects, delete) is straightforward. I've written the constraint into agents.md so a future sync run doesn't attempt it as a side effect.

---

Generated by Claude Code

[ralongit]

2. The duplicate Observability IQ category — not done, and I'd like your call first.

docs/open360/observability/ and docs/user-guide/observability/ are the same three pages twice (assistantiq.md, ai-agent-analysis.md, faq.md), which is why the category renders at both /docs/category/observability-iq/ and /docs/category/observability-iq-1/. You're right that they duplicate each other and overlap the OrionIQ pages.

I didn't delete them because it isn't a cleanup:

• 20 inbound links across 14+ pages point into them — from Explore, K8s 360, App 360/APM, PagerDuty, account-region, release notes, and both alerts pages. With onBrokenLinks: 'throw' every one has to be repointed or the build fails.
• They're live public URLs, so removal needs static/_redirects entries, and the AI Agent / AI Agent Analysis content has no home in the OrionIQ section today — the chat surface isn't documented there yet (that's the open gap in agents.md).

So it's a migration with a decision behind it: which tree survives, and where the AI Agent chat content lands. Happy to do it as a follow-up PR once you say which way — the mechanical part (repoint links, add redirects, delete) is straightforward. I've written the constraint into agents.md so a future sync run doesn't attempt it as a side effect.

Generated by Claude Code

I think we should have a follow up task to do a cleanup(more of a refactor).
Open360 & Cloud SIEM inner doc pages should only reference OrionIQ chat drawer per the relevant nested doc (Explore, Dashboards, App360, etc) and the Alert AI analysis agents.

The rest of the AI related info should live only in OrionIQ section like it does in the product.
FAQ should be broken down per platform ( Open360 / OrionIQ)

[galangel]

Second round addressed and pushed in 3d55bcd — replied on all four threads.

• create-agent.md — fair hit, my previous reply overstated it: the new sections landed below that table, so at that spot the diff really was just the Payload row vanishing. Agent Definition now documents its five real fields (Runbook, Guidelines, Agent tools, Output detail, Structured output) from agent-definition-fields.constants.ts, and says the payload is the raw JSON under Advanced · Agent Definition. Also noted that Agent tools drives the Data Sources picker and the form won't save with an unsatisfied lane.
• "AI Agent chat history" — corrected to the agent's invocation history in both alert pages.
• Alert + SIEM rule pages — new Configure the agent subsection on all three: enabling AI Analysis creates an agent you can update, via Configure agent after saving or Manage in Agent Hub, with Integrations, Agent tools, and its own daily cap.

On the refactor

Agreed, and thanks for making the call — that's a much better target than "delete the duplicates". I've written the direction into agents.md as decided rather than open:

• Open 360 and Cloud SIEM inner pages keep only the OrionIQ chat drawer reference on the relevant nested doc (Explore, Dashboards, App 360, K8s 360, …) plus Alert AI Analysis.
• All other AI content lives in the OrionIQ section only, matching the product.
• FAQ splits per platform — one Open 360, one OrionIQ.

Keeping it out of this PR as you suggested. Rough shape when we pick it up, so it's estimable:

1. Split observability/faq.md into an Open 360 FAQ and an OrionIQ FAQ; move the agent/chat content out of assistantiq.md into the OrionIQ section.
2. Reduce the per-product pages (Explore, K8s 360, App 360/APM, Dashboards) to a drawer reference each.
3. Repoint the 20 inbound links, add static/_redirects for every retired URL, and collapse the duplicate open360 / user-guide observability trees into one.

The one dependency worth flagging: step 1 needs the OrionIQ chat page that doesn't exist yet — still the open gap in agents.md, blocked on which surface the docs should describe (Open 360 drawer vs the standalone app). If you want, I can write that page first as its own PR and the refactor lands on top. Happy to open a tracking issue with the above if that's useful.

---

Generated by Claude Code