Investigate
Evidence and audit
Evidence is the record behind a claim MonitOps makes: the query, status, check or change it came from. The audit trail is the record of what was asked, proposed, approved and done, with identity and time.
How it works#
Evidence kinds#
| Kind | What it points to |
|---|---|
| Metric | A signal query over a window |
| Log | A log query, or a log template, over a window |
| Status | A provider incident or status report |
| Operational event | An event on an actionable definition |
| Topology | The service map as it stood, with its edges |
| Change | A change record |
| Check | A synthetic check result |
| Runbook | A passage of a runbook, with its revision |
Every link reopens its source#
An evidence reference binds the tenant, the entity, the time window and where the data came from. Opening it reruns the query or loads the record, and the request is authorized again for the person opening it. A reference carries no raw log text and no role. Because it is checked again, a person cannot reach data through a link that their role does not allow.
Observation, hypothesis, outcome#
What MonitOps measured, what it infers and what has been confirmed are labelled differently wherever they appear. In INC-20931: Observed · payments-gw 5xx 31 %, Probable · provider fault · relative confidence 0.81, Confirmed · recovered 14:09:52, verified by probes. Gaps in evidence are shown. See Cause assessment.
Confirm, reject, override#
A cause assessment or a summary can be confirmed, rejected or overridden, and the reason is recorded. Explanations written by MonitOps carry an AI-generated label. The correction is kept with the incident, together with the evidence it relied on, and that evidence is retained as a snapshot that outlives the retention period of the telemetry.
What is audited#
Every query, recommendation, approval and action is recorded with identity, time and the evidence it relied on. The incident timeline is the audit trail for an incident.
Audit trail
- 14:02:40Incident INC-20931 opened · 7 alerts grouped
- 14:03:05Probable cause ranked · payments-gw · provider
- 14:05:12Action requested · fail over card payments · Narin S.
- 14:06:30Action approved · Ploy K.
- 14:06:31Run RUN-5521 started
- 14:09:52Recovery verified · probes 20/20 · incident resolved
Changes to anything an administrator can change, such as sources, alarm definitions and destinations, are recorded as audit events with the values before and after the change and the source address. Authentication and authorisation changes are recorded without credentials or tokens.
Audit view, export and retention#
The audit view lists audit events and can be exported. Audit records stay in your environment, and are kept for a retention period agreed for the deployment (see Deployment and operations).
What you see in the console#
The incident timeline lists each detection, grouping, assessment, question, recommendation, approval, run and verification with its time. Each piece of evidence in an assessment or an answer is a link that reopens its source.
Limits and defaults#
- References are recomputed under the current role, so what a link shows can differ between a viewer and an operator.
- Generated summaries use only the attributes safe for a viewer, even when an operator asks for them.
Failure states#
- If a reference has expired, for example because the telemetry has been deleted, the link says so.
Related#
Last updated October 2026