AI-powered root cause analysis for incidents
AI root cause analysis starts from an alert and works towards a likely cause. Noci AI's agents investigate with your telemetry and your recent code changes, form a hypothesis and show the evidence behind it. They do not declare the cause. A person reads the evidence and decides, and you choose, step by step, whether an agent asks first.
What does root cause analysis involve during an incident?
The opening minutes of an incident follow a pattern. Open the alert. Find the right dashboard. Read the error logs. Check what was changed recently. Ask in the channel whether anyone touched the service. The work is mostly gathering, and it is the same gathering every time. Root cause analysis is the step after it: reading what you gathered and arriving at a reason the service behaved the way it did.
AI helps most with the gathering and the first reading. It does not remove the need for a person to judge the result.
What do Noci AI’s agents do?
When an alert arrives, Noci AI’s agents investigate it with your telemetry and your recent code changes.
- Read the alert. What fired, on which service, and when.
- Query the telemetry. The signals around the time the alert fired, from the tools you have connected.
- Look at recent code changes. What was changed shortly before, through your code integration.
- Form a hypothesis. A statement of what is probably going on and why.
- Show the evidence. The data the hypothesis rests on, so you can read it, not only trust it.
The output is a hypothesis with evidence, not a verdict. The agent says what it thinks and what it looked at. You can follow the same trail it followed.
Why a hypothesis and not an answer?
Because the cause of an incident is a conclusion, and conclusions have owners. An agent can see your telemetry and your code changes. It cannot see the conversation a colleague had last week, the customer who phoned, or the reason a dependency is configured oddly. A person can.
So the split is plain. The agent does the gathering and offers a reading. A person decides whether the reading is right, what to do about it and what to tell others. If you want to see how to test an agent before you trust it, read how to evaluate an incident agent.
Who decides what an agent may change?
You do. In Noci AI you choose, step by step, whether an agent asks before it acts. A step that touches something sensitive can wait for a person; a step that only reads can run on its own. The choice is yours for each step.
What should you ask of any root cause analysis tool?
- Does it show its evidence? A conclusion with no trail cannot be checked.
- Does it tell you what it looked at? The list of sources matters as much as the answer.
- Can you tell what it observed from what it inferred? A good report keeps them apart.
- Who decides what it may change? The answer should be you, for each step.
- What does it connect to? An agent can only reason about what it can read. See what an AI SRE is for the data such a tool needs.
Questions
Does AI root cause analysis tell me the cause?
It gives you a hypothesis and the evidence for it. The cause is a conclusion a person draws after reading that evidence, because a person owns the outcome and knows what the agent cannot see.
What does Noci AI's investigation read?
Your telemetry and your recent code changes. The integrations page lists the tools Noci AI connects to for alerts, telemetry and code.
What if the hypothesis is wrong?
Then the evidence shows it. Look for a tool that shows each step it took, so you can see what it checked and reject the hypothesis.
Can an agent change my systems while it investigates?
Agents can take actions, for example muting or unmuting a Datadog monitor. You choose, step by step, whether an agent asks before it acts.
How is this different from a dashboard?
A dashboard shows data and leaves the reading to you. An investigation reads the data for you, lines it up against recent changes and writes down what it found and why. You still decide.