SigSentry Documentation

The full grammar for chat slash commands across Slack, Teams, Discord, and Google Chat

The /sigsentry analyze command (or @SigSentry analyze in Teams / Google Chat) accepts a description, a time expression, and optional flags. The grammar is the same across all four chat platforms, with small platform-specific differences noted below.

Basic shape

/sigsentry analyze <description> <time-expression> [flags]

The bot parses the command into three pieces:

Piece	Required	Notes
Description	Yes	What's wrong, free-form text
Time expression	Yes	Window to query logs
Flags	Optional	`--project=<slug>` for now; more in future

Description

Anything between analyze and the time expression is the description. Quoting is unnecessary — multi-word descriptions work as-is:

/sigsentry analyze checkout returning 500s after deploy last 30 minutes
              ──────────────────────────────────────────  ──────────────
                              description                  time expression

Time expressions

Several patterns are supported:

Expression	Window
`last 30 minutes` (or `last 30 min`, `last 30m`)	30 minutes ending now
`last 4 hours` (or `last 4h`)	4 hours ending now
`last 1 day` (or `last 1d`)	24 hours ending now
`since 9am`	From 9am today to now
`since 14:30`	From 14:30 today to now (24-hour)
`since yesterday`	From midnight yesterday to now
`between 9am and 11am`	A specific window today
`between 2026-04-25 09:00 and 2026-04-25 11:00`	Explicit start/end

Time expressions are interpreted in the timezone of the user (detected from chat platform metadata where available, falling back to UTC).

Very wide time windows can produce a lot of logs. Narrow the window when possible to keep results focused.

Flags

Flag	Purpose	Example
`--project=<slug>`	Run on a specific project (overrides the default)	`--project=billing`
`--help`	Show inline help	(no analysis runs)

Examples

/sigsentry analyze high error rate from checkout last 30 min
/sigsentry analyze db timeouts since 9am
/sigsentry analyze auth failures last 4 hours --project=api
/sigsentry analyze deploy regression between 2026-04-25 14:00 and 2026-04-25 15:00
/sigsentry help

Platform-specific notes

Platform	Trigger	Special handling
Slack	`/sigsentry analyze ...`	Standard slash command
Teams	`@SigSentry analyze ...`	Bot mention; no slash command
Discord	`/sigsentry analyze` (form fields)	Structured UI rather than free-text — fill in the description, time, and project fields
Google Chat	`@SigSentry analyze ...`	Bot mention

Discord's slash command UI deserves special note: instead of typing the full command inline, Discord prompts you with structured fields for each parameter. The semantics are the same, just the input mode differs.

What the bot returns

For all platforms, after running the command:

The bot acknowledges with "Analyzing logs from <window>..."
The diagnosis posts within 30–60 seconds as a threaded reply
Subsequent messages in the thread are treated as follow-up questions on that analysis

If the analysis fails (e.g. log source down, quota exceeded), the bot replies with the error reason in the thread.

Defaults

If you skip --project, the bot picks:

The channel-level binding if one exists (set under Settings → Integrations → channel-bindings)
Otherwise, your default project

If neither resolves, the bot asks you to specify --project=<slug>.

Command grammar