Skip to content

SYSTEM INTELLIGENCE & TOPOLOGY

Understand the system behind the incident.

AutoObserve builds a living model of your production environment—runtime entities, dependencies, infrastructure, changes and ownership—giving AIDDE and Investigation the context required to reason about failures.

One system graph. Different operational questions.

SYSTEM INTELLIGENCE

A map shows connections. Intelligence explains why they matter.

SERVICE MAP

  1. Checkout
  2. Payment
  3. Stripe

KNOWN

  • Dependency
  • Traffic
  • Latency
  • Errors

SYSTEM INTELLIGENCE

Service

Checkout

v2.14.7 · Changed 83s ago

Service

Payment

▲ Impacted

External

Stripe

◐ Unknown

UNDERSTOOD

  • Runtime relationship
  • Health
  • Recent change
  • Temporal order
  • Incident context
  • Causal hypothesis
  • Blast radius
  • Ownership
  • Evidence

Topology isn't the visualization. The system model behind the visualization is the product.

01 / DISCOVER

Build a living model from how production actually behaves.

AutoObserve discovers runtime relationships from production evidence, then resolves heterogeneous entities into one System Graph.

OBSERVED TRACE

  1. checkout-api
  2. payment-api

DISCOVERED RELATIONSHIP

Runtime relationship

Request rate4.2k/min
Error rate8.7%
p95 latency812 ms
Observed throughOpenTelemetry traces
First observed42 days ago

Discovery sources

  • OpenTelemetrycore
  • Kubernetescore
  • Telemetry metadatacore
  • Changescore
  • Configurationplanned

SYSTEM GRAPH

Heterogeneous entities

team

Commerce

Healthy

service

Checkout

Healthy

v2.14.7

service

Payment

Healthy

pod

Pod-7f3

Healthy

database

orders-db

Healthy

external

Stripe

Unknown

Production doesn't stand still. Neither should its system model.

Traffic shifts, canaries, and ephemeral infrastructure change the graph without a static CMDB rewrite.

  1. 10:00

    Checkout ─────▶ Payment-v1

  2. 10:30

    Checkout ── 90% ▶ Payment-v1 · 10% ▶ Payment-v2

  3. 11:00

    Checkout ─────▶ Payment-v2

02 / UNDERSTAND CHANGE

The system you have isn't the system you had five minutes ago.

Topology without change history tells you what exists. Temporal topology helps explain what happened.

Incident timeline

  1. 14:30:00

    DEPLOYMENT

    checkout-api v2.14.2 → v2.14.7

  2. 14:31:23

    CHECKOUT LATENCY

    Checkout latency ↑

  3. 14:31:26

    CHECKOUT ERRORS

    Checkout errors ↑

  4. 14:31:29

    PAYMENT FAILURES

    Payment failures

  5. 14:31:34

    ORDERS FAILURES

    Orders failures

INCIDENT

14:31:34

Checkout v2.14.7 likely origin — Payment and Orders impacted

service

Checkout

Degraded

v2.14.7

LIKELY ORIGIN

service

Payment

Impacted

IMPACTED

service

Orders

Impacted

IMPACTED

Each state updates the same graph geometry—before, during, and after the incident—so change history stays visible without leaving the system model.

03 / REASON

A dependency is not a cause.

A dependency tells AutoObserve who talks to whom. It does not by itself tell AutoObserve who caused whom to fail.

Dependency

Checkout ───────▶ Payment

This tells AutoObserve: Checkout calls Payment.

Not a cause

Checkout caused Payment to fail

It does NOT tell AutoObserve: Checkout caused Payment to fail.

Build causality progressively

  1. DEPENDENCY

    Checkout ─────────▶ Payment

  2. TEMPORAL ORDER

    Checkout degraded 6 seconds earlier

  3. TELEMETRY EVIDENCE

    Failures propagate along dependency

  4. CHANGE

    Checkout deployed 83 seconds earlier

  5. CAUSAL HYPOTHESIS

    Checkout likely contributed to Payment degradation.

Causal edges are hypotheses—labeled likely, never declared fact.

Edge epistemology

  • Observed relationship

    Thin solid edge

    Checkout ─── calls ───▶ Payment

  • Inferred causal relationship

    Heavier/double edge + label

    Checkout ══ likely propagation ══▶ Payment

  • Unknown / unverified relationship

    Dashed edge

    Checkout ┄┄ possible ┄┄▶ Inventory

Structural timeline

  1. 14:30:00

    DEPLOYMENT

    checkout-api v2.14.2 → v2.14.7

  2. 14:31:23

    CHECKOUT LATENCY

    Checkout latency ↑

  3. 14:31:26

    CHECKOUT ERRORS

    Checkout errors ↑

  4. 14:31:29

    PAYMENT FAILURES

    Payment failures

  5. 14:31:34

    ORDERS FAILURES

    Orders failures

Causal path

service

Checkout

Degraded

v2.14.7

LIKELY ORIGIN

service

Payment

Impacted

IMPACTED

service

Orders

Impacted

IMPACTED

  • Temporal order
  • Dependency direction
  • Trace propagation
  • Recent deployment

04 / UNDERSTAND IMPACT

Know what a failure can affect before chasing every symptom.

Blast radius turns topology into operational scope — what is affected, what depends on it, and who owns the response.

Blast radius

Checkout is selected—toggle to clear blast radius focus.

service

Payment

Impacted

IMPACTED

service

Orders

Impacted

IMPACTED

external

Stripe

Unknown

INDIRECT

UPSTREAM

Who depends on Checkout?

  • Web

DOWNSTREAM

What does Checkout depend on?

  • Inventory
  • Payment
  • Orders

EXPLORE SYSTEM INTELLIGENCE

One system. Different questions.

The same System Graph answers different operational questions through lenses — without rebuilding the diagram.

PRODUCTION SYSTEM

14:31:34

QUESTION

Who talks to whom?

Observed runtime relationships

Selected

Checkout

service · Healthy · v2.14.7

Emphasised

Upstream

Downstream

Phase: DEPENDENCIES. Who talks to whom? Observed runtime relationships Selected entity: Checkout. Upstream dependents: Web. Direct dependencies: Inventory, Payment, Orders. Incident state: Stripe: Unknown.

SYSTEM INTELLIGENCE

System Intelligence gives machine reasoning context.

AIDDE and Investigation consume the System Graph for situation formation, causal testing, and impact — Topology is the structural dimension of the same incident.

PLATFORM CONTEXT

  • Production signals

    • Metrics
    • Logs
    • Traces
    • Changes
  • System Graph

    • Entities
    • Relationships
    • Ownership
    • Blast radius
  • Reasoning consumers

    • AIDDE
    • Investigation
    • Product UX

AIDDE uses runtime relationships to group signals into incidents.

WITHOUT SYSTEM INTELLIGENCE

  • Checkout latency spike
  • Payment error rate rise
  • Orders write failures

3 SIGNALS

WITH SYSTEM INTELLIGENCE

  • Checkout latency spike
  • Payment error rate rise
  • Orders write failures

1 INCIDENT CANDIDATE

Investigation strengthens or weakens hypotheses against the System Graph.

  • WEAKENED

    Payment provider caused checkout failures

    Dependency exists, but temporal order and traces contradict origin.

  • STRENGTHENED

    Checkout deploy likely contributed

    Graph path + change window + expected indicators align.

System Intelligence asks where. Multi-DSL asks what happened.

Topology supplies structural questions; Multi-DSL supplies telemetry evidence for Investigation context.

SYSTEM INTELLIGENCE

  • WHERE?
  • WHAT DEPENDS?

MULTI-DSL

  • WHAT HAPPENED?
  • WHEN?

TECHNICAL FOUNDATION

How System Intelligence is built.

Discovery sources feed entity resolution and relationship discovery into a System Graph consumed by AIDDE, Investigation, and product UX.

  1. 01

    Discovery Sources

  2. 02

    Entity Resolution

  3. 03

    Relationship Discovery

  4. 04

    System Graph

  5. 05

    AIDDE · Investigation · Product UX

DISCOVERY SOURCES

  • OpenTelemetryCORE
  • KubernetesCORE
  • Telemetry metadataCORE
  • ChangesCORE
  • ConfigurationPLANNED

Core definitions

  • Entity

    Something that exists in the runtime environment.

    Service · Pod · Deployment · Database · Queue · Cloud Resource

  • Relationship

    A typed connection between entities.

    calls · runs_on · reads_from · owns · depends_on

  • Observation

    Runtime evidence associated with an entity or relationship.

    Request rate · Error rate · Latency · Trace spans

  • Change

    An event that modifies system state.

    Deployment · Config change · Scaling event

Snapshot semantics live in product docs — not on this page.

For Platform Engineering →