01 A connected causal evidence window
Bring event order, metrics, logs, Flow, paths, topology, service dependencies and changes into the selected incident window. Evidence retains its source and quality so the explanation can be inspected back to the observations that support it.
02 Protocol-aware causal constraints
Use device and protocol semantics with canonical relationships to assess plausible propagation paths. A routing adjacency event, interface fault and downstream reachability change can be evaluated in their operational sequence.
03 ML and graph-assisted prioritization
Statistical baselines and learned graph features help rank anomalies, likely root entities, propagation patterns and affected scope. Model scores supplement the observed evidence and deterministic constraints, making complex incidents easier to prioritize.
04 Explicit alternative hypotheses
Retain candidate causes, contributors, amplifiers and symptoms with their supporting and contradictory evidence. Compare explanations instead of reducing every correlated event to a single unqualified conclusion.
05 Counterfactual verification
Ask which upstream or downstream effects should exist if a hypothesis is correct. Healthy independent paths, absent expected symptoms or a stronger alternative can lower confidence and direct the next test.
06 Cross-domain change intelligence
Correlate NCM, routing, cloud control plane, deployments, database changes, certificate rotation and maintenance evidence. Relevance, timing, expected effects and service impact determine how a change contributes to the explanation.
07 Redundancy and shared-risk reasoning
Consider active and alternate paths, quorum behavior and known common dependencies such as hypervisors, storage fabrics, carrier circuits or power domains. Distinguish a component failure from lost resilience and actual service impact.
08 Revisioned conclusions as evidence arrives
New or delayed observations can produce a new RCA revision with the updated reasoning. Earlier conclusions remain available so teams can understand how a diagnosis evolved rather than losing the original evidence trail.
09 Explainable next tests and runbooks
Present the probable cause or an inconclusive result, confidence, affected scope, missing evidence and useful validation actions. Copilot can explain the findings and suggest permitted tests while normal authorization governs every action.
10 Feedback and incident memory
Capture accepted or rejected causes, missing evidence and remediation outcomes. Similar Incident Memory brings relevant historical patterns and runbooks into view, with matching factors and evidence links for the operator to assess.