Root cause analysis & correlations

Two related screens under Intelligence try to shorten the distance between “something broke” and “here’s why”: one suggests a probable cause once an incident is resolved, the other looks for patterns across multiple services that might be the same underlying problem showing up more than once.

Root cause analysis

Intelligence → Root Cause Analysis (/gravity/operations/rca) lists RCA candidates - a probable cause, supporting evidence, and (where applicable) a suggested fix, generated after an incident is resolved.

Each candidate shows:

• A probable cause headline
• A confidence score as a percentage - colored green above 70%, amber between 40% and 70%, red below that
• Evidence - an expandable list of the specific signals behind the suggestion (for example, a correlated change request or a cost anomaly around the same time), each with a short description and source
• A suggested fix, when one was generated
• Which model produced it, and when

You can filter by status or by a specific incident’s ID - arriving here from an incident’s own page pre-fills that filter for you.

For a candidate still pending review, you can:

• Accept it - records that your team confirmed it as the (or a) real cause
• Reject it - records that it wasn’t

Either action is a record-keeping step: it updates the candidate’s status and is logged, but it doesn’t automatically create a runbook, a change request, or any other follow-up action on its own - you still decide and trigger whatever comes next yourself. Both actions require the Member role or higher.

Where a candidate was generated by a language model rather than a simpler rule-based check, the model name is shown alongside its confidence score, so you can weigh a suggestion accordingly - confidence from a rule-based fallback tends to be more conservative than one from a full analysis.

Note

RCA candidates are generated automatically when an incident resolves, but that generator is opt-in per environment. If you resolve incidents and never see a candidate appear, that’s most likely because it isn’t turned on for your organization - check with your account team.

Correlation findings

Intelligence → Correlations (/gravity/operations/correlations) surfaces patterns detected across multiple services or signals - for example, a cascade failure, an availability, performance, security, or cost-shaped pattern - rather than a single incident’s cause.

Each finding shows its pattern description, a confidence level (high, medium, or low), a status (new, investigating, resolved, or false positive), the affected services, an evidence summary, and a count of the underlying events behind it. For a new or investigating finding, you can Dismiss it.

Finding type	What it’s flagging
Cascade failure	One failure that appears to have triggered others downstream
Availability	A pattern in uptime/availability signals across services
Performance	A shared slowdown pattern across more than one service
Security	A security-relevant pattern spanning multiple signals
Cost	A cost pattern correlated with other operational signals

Note

Like RCA, correlation detection runs on a recurring schedule that has to be enabled for your environment - the platform’s design intent is roughly every 15 minutes once it is. An empty list here can mean either that nothing has correlated, or that detection isn’t active yet for your account.

What’s next

• Incidents - where RCA candidates originate
• Recommendations - a related, broader stream of proactive suggestions
• Auto-remediation - turning a confirmed cause into an automatic fix, a separate, manual setup step
• Knowledge graph