Topology-Aware Incident Management

Neux 2 min read
Evidence Solid

Correlating alerts through a dependency graph is an established observability practice; the shared semantic model is what lets telemetry from different tools be correlated at all.

We route telemetry from every tool through one shared model of your system, so that an alert arrives as a statement about a known component with known dependencies, and an incident is worked from its cause rather than its symptoms.

Telemetry that does not agree with itself

Metrics, logs and traces usually come from different tools, each with its own names for the same things. A host is a hostname in one, an instance identifier in another, a pod in a third. During an incident, the first task is translation, performed by people, under pressure.

One model, many sources

We map every telemetry source to the same ontology that describes the infrastructure and the business capabilities it serves. A signal is then attached to the component it concerns, whatever the tool that produced it called it. Unified service telemetry is not a single tool; it is a single vocabulary that every tool’s output is read into.

Incidents worked from the graph

With signals attached to components and components linked by dependency, the graph shows where the failures cluster and what sits upstream of them. Alerts on a dozen services that all depend on one degraded queue are one incident, not twelve. The blast radius of a failing component is a query, and it names the capabilities affected in business terms.

After the incident

The same model records what changed before the failure, because the release pipeline writes to it. The post-incident review reads the sequence from the graph: the change, the components it touched, the signals that followed. Your operational resilience improves because each incident leaves the model more complete than it found it.

Keep reading

All explainers