Investigate
Cause assessment
For each incident MonitOps ranks candidate causes, classifies each one and shows the evidence behind it. The ranking is computed in code from named features; an AI investigator tests the top candidates but cannot change the ranking by assertion.
How it works#
Candidates#
The candidates are the symptom entity and every entity upstream of it on the service map, up to three hops away, using declared and observed edges as they stood when the incident opened. For INC-20931, whose shared path is checkout-web → order-api → payments-gw, the candidates include order-api and payments-gw.
Features#
Each candidate is scored from features, each normalised to the same range.
| Feature | What it measures |
|---|---|
| Provider status | Whether the provider reported an incident on the candidate or its parent system in the window; maintenance counts for less |
| Change | Whether a recent change touched the candidate |
| Temporal | Whether the candidate's anomaly began before the symptom's; the closer, the higher |
| Error signal | New error signatures against the baseline, or a new operational event |
| Severity | How strongly the candidate's signals departed from their baseline |
| Proximity | How close the candidate is to the symptom on the map; the symptom itself is closest |
| Evidence support | Added after investigation: evidence that supports the candidate raises it, evidence that refutes it lowers it |
Scoring and relative confidence#
A weighted combination of the features gives each candidate a raw score. The scores are compared across the whole candidate set to give relative confidence, before the top three are selected. The assessment returns the top three with each one's feature breakdown, the number of candidates considered and whether the evidence is sufficient.
Cause class#
Each candidate is classified from the same features as application, integration or provider. The incident uses the class of its leading supported candidate. An integration classification needs affirmative support, not only a high ranking.
A provider classification needs a relevant provider incident and matching symptom evidence. Maintenance alone is context, not proof. Entity type locates a hypothesis; it does not confirm a cause.
The investigator#
An AI investigator takes the top candidates and tries to confirm or refute each with evidence from logs, metrics, changes and topology.
- Every cited result is validated in code against explicit support and refutation rules before it can affect the ranking. Assertions that fail validation contribute nothing.
- The investigator cannot set a score, a confidence or a class.
- Each piece of evidence reopens the query, provider incident, probe result or change record it came from.
What you see in the console#
In INC-20931 at 14:03:05, the assessment lists:
| Rank | Candidate | Cause class | Relative confidence |
|---|---|---|---|
| 1 | payments-gw | provider | 0.81 |
| 2 | order-api | integration | 0.12 |
The contributing features of the first candidate are shown as provider status · temporal · error signal. It has four pieces of evidence: the payments-gw 5xx rate against its baseline, upstream timeout calling payments-gw (8000ms) repeated in the order-api logs, the provider status report, and the topology showing order-api healthy on every other dependency.
Late evidence#
When evidence that arrives late, such as provider event logs, is attached to an incident, the scorer runs once more on the updated inputs. The re-run is recorded on the incident timeline.
Failure states#
Insufficient evidence#
When the evidence does not support a ranking, the assessment says so and lists what is missing. It does not force a cause, even when one candidate ranks highly.
Insufficient evidence
Insufficient evidence to rank a cause. Missing: provider status feed (stale 42 min).
Investigator unavailable#
If the investigator is unavailable, the computed ranking is shown and marked as such. Detection, correlation and scoring continue; only the investigator's confirmation or refutation is missing.
Limits and defaults#
- Scores come from code; weights are configuration.
- The investigator reviews the top three candidates.
- The assessment exposes relative confidence, never a probability.
Related#
Last updated October 2026