A platform for correlating alerts and deploys
Correlating alerts and deploys means checking what changed shortly before an alert fired. Noci AI brings alerts, telemetry and recent code changes from the tools you connect into one context, and its agents investigate with them and report a hypothesis with the evidence. A person reads the evidence and decides what to do.
Why correlate alerts with deploys at all?
When something starts failing, the first useful question is what changed. A code change is a common answer, and it is cheap to rule in or out. If a change went out shortly before the alert and touched the service that is alerting, it is worth reading first. If nothing did, you can move on to the next idea sooner.
The trouble is that the pieces live in different tools. The alert is in a monitoring tool, the change is in a code tool, and the conversation about it is in chat. Correlation is the work of putting them side by side, and it is done by hand at the worst possible time.
How does Noci AI correlate an alert with recent changes?
When an alert arrives, Noci AI’s agents investigate it with your telemetry and your recent code changes. In order:
| Step | What happens |
|---|---|
| The alert arrives | It comes from one of the alert and telemetry tools you have connected |
| The agents investigate | They work it with your telemetry and your recent code changes |
| They report a hypothesis | A statement of what is probably going on, with the evidence it rests on |
| A person decides | What to do next, and what to tell others |
The change side comes from your code integration, GitHub. The alert and telemetry side comes from the alert and telemetry tools you connect, which the integrations page lists.
Where do the facts come together?
In Noci AI’s Context Lake: one place where technical signals and customer tickets from the tools you connect sit together, so the page, the incident channel and the investigation begin from the same facts. If you want the longer explanation of the idea, read what an incident context lake is.
The point is not a bigger pile of data. It is that the person who joins late, and the agent that started a minute earlier, are looking at the same things.
What can correlation not tell you?
Timing is not cause. A change can land just before an alert and have nothing to do with it, and a failure can start from something that never appears in a code tool: a dependency, a limit, a traffic pattern. Noci AI’s agents show the evidence behind their hypothesis, so you can see how strong the link is. A person weighs it and decides. For how the hypothesis and the decision are divided, see AI root cause analysis.
What should you ask of any correlation tool?
- What can it read? It can only line up what it can see. Check the list of tools it connects to.
- Does it show when each change landed? A correlation with no timeline cannot be checked.
- Does it say what it did not look at? An honest report names its gaps.
- Does it start before a person arrives? The value is in the first minutes, not the fifth.
- Where do the results go? They should land where the team already works, so nobody has to ask again.
The same flow for one specific tool is in incident correlation for Datadog alerts.
Questions
What does it mean to correlate an alert with a deploy?
It means asking whether a change went out shortly before the alert, and whether that change touched the service that is alerting. The question is old. Answering it quickly, from one place, is the part software can do.
Which tools does Noci AI correlate across?
The tools you connect for alerts, telemetry, code and support tickets. The integrations page lists every one, including the alert and telemetry tools and GitHub for code.
Does a change before an alert mean the change caused it?
No. Timing is a clue, not a cause. Noci AI's agents show the evidence behind a hypothesis, and a person decides whether the change is the reason.
Where do the alerts, changes and tickets come together?
In Noci AI's Context Lake, which holds technical signals and customer tickets from the tools you connect, so agents and people start an incident from the same facts.
Do I have to move my alerts out of my current tools?
No. Noci AI connects to your alerting and telemetry tools; your alerts reach Noci AI from them.