Change Intelligence

The change-correlation engine links signals (anomalies, alerts, incidents) to the infrastructure changes most likely responsible, with noise reduction and higher precision.

Adaptive lookback

The search window adjusts automatically by signal type:

  • Anomalies — looks back over the last 7 days.
  • Alerts — looks back over the last 4 hours.
  • Incidents — looks back over the last 2 hours.

AWS service matching

  • Automatic ARN parsing in change events to extract the affected service.
  • A static dictionary maps services to metric names and resources.
  • Candidates that share a service with the signal get higher relevance.

Noise suppression & damping

  • Filters SSM/Teleport heartbeats, autoscaling alarms, and AWS maintenance events.
  • Candidates without a service relationship are damped (proximity × 0.3), reducing false positives.