Causal hypotheses, change intelligence & service impact

Understand the cause with evidence you can inspect.

An incident may produce hundreds of symptoms across teams. AmrudAi combines protocol behavior, temporal topology, metrics, logs, Flow and change evidence to rank defensible causes, explain the affected service and guide the next useful verification.

The application experience

Investigation Workbench

See the complete workspace. Enlarge any image to inspect its panels, navigation and evidence at actual size.

Evidence-Led RCA Workbench — illustrative product view with sample data. Illustrative product view · Sample data
Bring hypotheses, contradictions, configuration changes and remediation checks into one investigation.

Move past a probable-cause label.

Give the next engineer an explanation they can inspect.

AmrudAi evaluates competing hypotheses against qualified telemetry, topology, recent changes and independent evidence. Supporting, contradictory and missing information stays visible. The investigation proposes the next useful check and preserves revisions as new facts arrive.

The capability in detail

Move from correlated symptoms to a defensible explanation.

01

A connected causal evidence window

Bring event order, metrics, logs, Flow, paths, topology, service dependencies and changes into the selected incident window. Evidence retains its source and quality so the explanation can be inspected back to the observations that support it.

02

Protocol-aware causal constraints

Use device and protocol semantics with canonical relationships to assess plausible propagation paths. A routing adjacency event, interface fault and downstream reachability change can be evaluated in their operational sequence.

03

ML and graph-assisted prioritization

Statistical baselines and learned graph features help rank anomalies, likely root entities, propagation patterns and affected scope. Model scores supplement the observed evidence and deterministic constraints, making complex incidents easier to prioritize.

04

Explicit alternative hypotheses

Retain candidate causes, contributors, amplifiers and symptoms with their supporting and contradictory evidence. Compare explanations instead of reducing every correlated event to a single unqualified conclusion.

05

Counterfactual verification

Ask which upstream or downstream effects should exist if a hypothesis is correct. Healthy independent paths, absent expected symptoms or a stronger alternative can lower confidence and direct the next test.

06

Cross-domain change intelligence

Correlate NCM, routing, cloud control plane, deployments, database changes, certificate rotation and maintenance evidence. Relevance, timing, expected effects and service impact determine how a change contributes to the explanation.

07

Redundancy and shared-risk reasoning

Consider active and alternate paths, quorum behavior and known common dependencies such as hypervisors, storage fabrics, carrier circuits or power domains. Distinguish a component failure from lost resilience and actual service impact.

08

Revisioned conclusions as evidence arrives

New or delayed observations can produce a new RCA revision with the updated reasoning. Earlier conclusions remain available so teams can understand how a diagnosis evolved rather than losing the original evidence trail.

09

Explainable next tests and runbooks

Present the probable cause or an inconclusive result, confidence, affected scope, missing evidence and useful validation actions. Copilot can explain the findings and suggest permitted tests while normal authorization governs every action.

10

Feedback and incident memory

Capture accepted or rejected causes, missing evidence and remediation outcomes. Similar Incident Memory brings relevant historical patterns and runbooks into view, with matching factors and evidence links for the operator to assess.

From information to action

Build confidence by testing the explanation.

  1. 01

    Open the evidence window

    Start with the affected service, qualified incident and temporal graph, keeping signal quality and event order visible.

  2. 02

    Compare the plausible causes

    Review root candidates, causal paths, changes, supporting facts and contradictions, including the service's surviving dependencies.

  3. 03

    Acquire the distinguishing evidence

    Run the permitted check that can separate alternatives. Keep denied, missing or conflicting results explicit.

  4. 04

    Validate and retain the conclusion

    Confirm the observed recovery or record the remaining uncertainty; preserve the RCA revision, accepted outcome and follow-up runbook or problem action.

Built around your operating environment

Fit the way your team operates.

Combine deterministic protocol reasoning, statistical and graph-based ranking, and operator verification within one evidence model.

  • Cause, contributing factors, symptoms and monitoring failure remain distinguishable.
  • Supporting, contradictory and missing evidence accompany confidence and impact.
  • Incident-time topology, service resilience and relevant changes inform the explanation.
  • Revisions, accepted feedback and similar-incident references preserve the learning context.

What evidence supports a root-cause finding?

Is the RCA produced only by a language model?

No. AmrudAi combines protocol-aware reasoning, temporal graph relationships and operational evidence, with statistical and learned graph scores supporting prioritization. Copilot explains the authorized evidence and recommends useful next checks.

What happens when the evidence is incomplete or contradictory?

The result retains the gaps, conflicting observations and alternative hypotheses. Confidence can fall and the conclusion can remain inconclusive, with the next useful validation made explicit.

Does a recent change automatically become the root cause?

No. Change intelligence evaluates the affected dependency, timing, expected effects and contradictions. A change is a candidate supported or rejected by evidence rather than a cause established only by proximity in time.

Can an RCA result change as new evidence arrives?

Yes. Material new information can produce a new revision with updated confidence and reasoning. Earlier revisions remain accessible so the team can inspect what was known at each point in the investigation.

See the workflow in your environment.

Explore the technology, service dependencies and operating requirements that matter to your team.