One timeline, focused diagnostics & preserved context
Incident work slows down when every tool resets the context. AmrudAi keeps the service, entity, time window and evidence together while operators compare signals, run focused diagnostics, inspect changes and hand over a complete investigation.
The application experience
See the complete workspace. Enlarge any image to inspect its panels, navigation and evidence at actual size.
Complete the operational workflow
Carry the Investigation Workbench, Incident Flight Recorder and Unified Operations Timeline into shift handover. Preserve current impact, ownership, facts, hypotheses, completed checks and the next validation so the incoming engineer can continue the work.
Connect approved runbooks, Similar Incident Memory and reviewed post-incident reports to the relevant service context. Prior incidents guide the investigation while the current evidence establishes what is happening now.
Stop restarting the investigation at every handover.
The Investigation Workbench brings alerts, timelines, topology, logs, flow, host evidence, diagnostic results and decisions into a common incident context. Engineers inherit the work already performed, including what was disproved and what remains unanswered.
The capability in detail
Inspect metrics, incidents, Flow, logs, events, topology, paths, changes, service telemetry and ITSM activity through a shared scope and time window. Selecting evidence keeps related panes connected to the same investigation.
Place telemetry transitions, routing events, deployments, configuration changes, maintenance, external updates and recovery evidence in sequence. Distinguish event time, observation time and delayed ingestion when reconstructing what happened.
Open the applicable Ping, path, SNMP, TCP, DNS, SSH, API, configuration or infrastructure checks from the entity or incident. Permissions and technology context determine the available actions while the originating view remains intact.
Run a deterministic diagnostic bundle and inspect each result, including unsuccessful or contradictory checks. Compare authorized Sensor or Agent vantages to distinguish a destination issue from a local path or collection problem.
Keep operator-triggered verification distinct from routine monitoring, with result time, vantage, scope and quality. A fresh successful test or failed check can be assessed alongside the historical signal that started the investigation.
Collect diagnostic results, notes, CLI references and graph, configuration, Flow or log snapshots in a persistent session. A session can begin before an incident exists and be linked later without losing its original evidence context.
Preserve a bounded before, during and after evidence window covering the relevant graph, telemetry, paths, events and changes. Review a transient failure after recovery, even when the live estate has moved on.
Compare current state with the pre-incident interval, a baseline, peer entity or approved change. Bring relevant configuration, deployment, routing and other change evidence into view without assuming that temporal proximity proves cause.
Use temporary Investigation Mode, endpoint diagnostic snapshots or triggered packet evidence when the case needs more detail. Explicit scope, permissions, time, resource and stop limits govern the collection and its return to normal behavior.
Link the current hypothesis, evidence, approved runbook, ITSM record and responsible owner. Copilot can summarize authorized findings and suggest permitted checks, while a preserved session supports escalation and post-incident review.
From information to action
Open an entity, service or incident and create the Investigation Session with the relevant scope and window.
Compare metrics, logs, Flow, topology and changes; distinguish observed facts, hypotheses and external statements.
Run the permitted targeted check or diagnostic bundle, retaining source, time, completeness and contradictory results.
Attach the decisive evidence, resulting action and recovery validation, then link the session to the incident, ticket or review.
Built around your operating environment
Run investigations through the relevant network, infrastructure, database, cloud and service actions, with permissions and evidence scope carried throughout.
Connect the workflow
Yes. An Investigation Session can start from an entity or service and collect its own evidence and notes. It can later be linked to an incident while preserving the original timestamps and provenance.
The session holds the context, notes and evidence for the work. Investigation Mode temporarily changes permitted collection depth or cadence under explicit limits, then returns to normal behavior. The two work together but serve different purposes.
Live Evidence records an operator-triggered check with its execution time, source vantage and quality. Routine charts describe the monitoring history. Keeping them distinct helps the responder see what was observed during the incident and what was verified afterward.
Suggested tests come from the permitted diagnostic catalogue and still pass normal authorization, target, parameter and resource controls. Privileged CLI and configuration actions retain their applicable approval, credential and audit requirements.
Explore the technology, service dependencies and operating requirements that matter to your team.
Search the complete website · Esc to close · Tab to navigate results