Evidence · Deployment
Deployment
checkout-api:v2.14.7 deployed 8m before incident
- Source
- Kubernetes API
- Time
- 14:02:11
Correlationhigh
THE AUTOBSERVE PLATFORM
From production signals to production intelligence.
AutoObserve connects telemetry, changes, topology and operational context into an intelligence system that detects meaningful situations, investigates causes, understands impact and drives evidence-backed decisions.
Production
- Metrics
- Logs
- Traces
- Events
- Changes
- Topology
Evidence
Production Intelligence
- Detect
- Investigate
- Understand
DecideRespondLearn ↺
Multi-DSL Evidence Engine
Powered by CIR · Knowledge · Policy
FROM OBSERVABILITY TO INTELLIGENCE
Production doesn't need more signals. It needs understanding.
CONVENTIONAL TOOLS
Telemetry
Queries
Dashboards
Alerts
Engineer
Manual investigation
AUTOBSERVE
Telemetry + Changes + Topology
Evidence
Situation Detection
Investigation
Causal Understanding
Decision
Signals become evidence. Evidence becomes understanding. Understanding becomes a decision.
01 — EVIDENCE
A signal isn't an incident. It's evidence.
Production constantly emits partial observations. AutoObserve connects those observations with system context before deciding what they mean.
- Signal
- Change
- Relationship
- Impact
- Context
Intelligence is traceable back to source evidence.
PRODUCTION EVIDENCE
Explore metrics, logs, traces and changes in shared context.
AutoObserve connects telemetry across services, dependencies and production changes—preserving context while you move between evidence types.
Production
- Metrics
- Logs
- Traces
- Events
- Deployments
- Kubernetes changes
- Topology
- Infrastructure
Evidence Layer
DEVIATION
Checkout latency +184%
DB spans +412 ms vs baseline
CHANGE
Deployment v2.14.7
8m before incident
RELATIONSHIP
Checkout → Payment
2 downstream services
Provenance
From checkout-latency — every card links back to its source.
Evidence · Metric
Metric
p95 latency +184%; connection acquisition timeouts +930%
- Source
- Prometheus
- Time
- 14:05:42
Correlationhigh
Evidence · Trace
Trace
DB spans +412 ms versus baseline
- Source
- OpenTelemetry
- Time
- 14:06:18
Correlationhigh
Evidence · Kubernetes
Kubernetes
checkout-api restarted ×3 during the window
- Source
- Kubernetes API
- Time
- 14:07:03
Correlationmedium
Evidence · Log
Log
connection acquisition timeout messages spike
- Source
- OpenTelemetry
- Time
- 14:06:51
Correlationhigh
Evidence · Historical pattern
Historical pattern
Baseline deviation vs prior 7 days of checkout p95
- Source
- AutoObserve baselines
- Time
- 14:08:00
Correlationmedium
02 — INTELLIGENCE
From evidence to explanation.
Does this matter?
Does this matter?
AIDDE evaluates evidence collectively instead of turning every anomalous signal into another interruption.
We interrupt less, but better.
Explore AIDDE →AIDDE decision
Checkout degradation
- Deviation
- Significant
- Correlation
- Strong
- Customer impact
- High
- Related change
- Found
- Blast radius
- 2 services
- Confidence
- 94%
Decision
● Investigate
Customer-impacting degradation with multiple correlated evidence sources.
Suppressed
CPU deviation
- Impact
- None
- Blast radius
- Isolated
- Confidence
- 42%
Decision
Suppressed
No customer impact and weak correlation to the checkout path.
What explains it?
Why is checkout failing?
Hypotheses compete. Confidence rises as supporting evidence accumulates — and drops when evidence contradicts.
Hypotheses
Selected hypothesis
checkout-api deployment
Supporting evidence
- Degradation began 83 sec after deployment v2.14.7
- New checkout error signature appeared
- Failed traces originate at checkout-api
- Downstream propagation matches topology
Contradicting evidence
- Host CPU remained normal
- Host memory remained normal
Confidence over time
14:31:24
38%
14:31:42
74%
14:31:50
68%
14:32:12
91%
Uncertainty → evidence acquisition → belief update — not magic AI.
What caused what—and what is affected?
The same incident becomes graph context — switch semantic lenses to see dependencies, causal path, blast radius, or changes.
Question
How might this incident be propagating?
Checkout is the likely origin — not a declared root cause
service
Checkout
Degraded
v2.14.7
LIKELY ORIGIN
service
Payment
Impacted
IMPACTED
service
Orders
Impacted
IMPACTED
Likely origin
Checkout
Degraded · v2.14.7 · LIKELY ORIGIN
Downstream
- Inventory
- PaymentIMPACTED
- OrdersIMPACTED
Phase: CAUSAL. How might this incident be propagating? Checkout is the likely origin — not a declared root cause Selected entity: Checkout. Upstream dependents: Web. Direct dependencies: Inventory, Payment, Orders. Incident state: Checkout: Degraded (LIKELY ORIGIN); Payment: Impacted (IMPACTED); Orders: Impacted (IMPACTED); Stripe: Unknown.
03 — DECISION
An explanation isn't a decision.
Many products can generate an explanation. Fewer establish a coherent model for evidence, uncertainty, impact, and policy → decision.
Assessment
- Root cause
- checkout-api v2.14.7
- Confidence
- 94%
- Impact
- HIGH
- Scope
- checkout-api → payment-service
- Trajectory
- WORSENING
Policy
- Environment
- Production
- Service
- Tier 1
- Customer impact
- Customer-facing path
- Required confidence
- > 85%
Decision
INTERRUPT ON-CALL
Policy thresholds met. Confidence and customer impact justify paging on-call.
04 — RESPONSE
The right decision. The right level of automation.
Graduated autonomy — observe, involve a human, or recommend automation — then verify what happened.
From the decision
OBSERVE
AvailableContinue monitoring
Outcome recorded
HUMAN
AvailableNotify / Page engineer
Outcome recorded
AUTOMATION
PreviewRecommend action → Approved workflow
VERIFY
RECOVEREDESCALATE
Observe and human paths record an outcome. Automation adds an approved workflow, then verify.
PLATFORM DIRECTION
RoadmapIncident memory
Outcomes feed future investigations. Self-learning behaviour is directional — not claimed as shipped.
Outcome → memory
- Root cause confirmed
- False positive
- Suppression correct
- Remediation succeeded
- Hypothesis rejected
Outcome types include remediation results as a directional memory shape — not a claim that autonomous remediation is generally available.
Outcome → Incident memory → Future investigations
05 — FOUNDATION
One intelligence system across all your production data.
After the what comes the how — one layered system from production data through the Multi-DSL evidence engine to intelligence.
PRODUCTION INTELLIGENCE
- Detect
- Investigate
- Understand
- Decide
- Respond
REASONING
- Hypotheses
- Causality
- Confidence
- Impact
- Policy
EVIDENCE
- Signals
- Changes
- Relationships
- Context
- Knowledge
MULTI-DSL EVIDENCE ENGINE
- Planning
- Query Generation
- Execution
- Normalisation
PRODUCTION DATA
- Metrics
- Logs
- Traces
- Events
- Changes
- Topology
MULTI-DSL EVIDENCE ENGINE
Turn production questions into evidence.
AutoObserve plans and executes the queries required to answer production questions across metrics, logs, traces, changes and system context—while preserving the queries, sources and evidence behind every answer.
Investigation need
“Why did checkout failures increase after 14:31?”
Evidence planner
Evidence plan
5 evidence requests
Metrics · Logs · Traces · Changes
Unified evidence
Reasoning
Evidence plan
- 01
ESTABLISH DEGRADATION
Did checkout latency and errors change?
- 02
IDENTIFY ERROR SIGNATURES
Did new application errors appear?
- 03
LOCATE FAILURE ORIGIN
Where do failed requests first break?
- 04
IDENTIFY RECENT CHANGE
What changed immediately before degradation?
- 05
NORMALISE EVIDENCE
Map DSL results into a shared evidence object for reasoning.
Generated queries
Metrics
PromQL
histogram_quantile(0.95, sum(rate(http_request_duration_seconds_bucket{service="checkout-api"}[5m])) by (le))Logs
LogQL
{service="checkout-api"} |= "connection acquisition timeout"Traces
TraceQL
{ resource.service.name = "checkout-api" && name = "db.query" } | duration > 400msExecution details
- Intent
- Why did checkout failures increase after 14:31?
- CIR· Canonical Intermediate Representation
- Canonical Intermediate Representation — a normalised investigation plan before DSL-specific queries.
- Source execution
- PromQL, LogQL, and TraceQL run against existing telemetry backends.
- Evidence normalisation
- Results land as typed evidence with source, timestamp, and correlation.
OPEN ARCHITECTURE
Work with the stack you already have.
Adopt AutoObserve without rebuilding your telemetry architecture.
YOUR ENVIRONMENT
ApplicationsInfrastructure
OpenTelemetry
AutoObserve
EXISTING PRODUCTION SYSTEMS
Works alongside — not a replacement.
- Prometheus
- Kafka
- ClickHouse
- Kubernetes
- Cloud
- Other sources
BUILT FOR ENGINEERS
Built for engineers
OPEN STANDARDS
- OpenTelemetry-native
- API-first
DEPLOY YOUR WAY
- Docker
- Kubernetes
- Helm
- Self-hosted
INSPECTABLE
- Evidence provenance
- Reasoning
- Confidence
- Decisions
- Production then
- Evidence then
- Intelligence then
- Decision then
- Response with learning feedback
Production intelligence, end to end.
From raw production evidence to explainable decisions, AutoObserve connects the investigation instead of leaving engineers to assemble it manually.