Findings that arrivewith their evidence attached
Analysis produces signals, signals become investigations, investigations become reports — and at every step the underlying records travel with the conclusion. A finding you cannot open is a finding you have to take on trust, which is the one thing an analyst should never have to do.
The working surface, part by part
Signals
anomaly · pattern · weak signalEach signal names its subject, the method that produced it, a confidence, and the knowledge objects it was computed from. Severity is derived from confidence rather than assigned, so two findings at the same confidence cannot be ranked differently by whoever wrote them.
Search across everything ingested
keyword · semantic · hybridOne search over entities, documents, events and insights, in three modes. Hybrid combines the full-text index with vector similarity; results carry their source and their score, and every hit opens onto the record behind it.
Investigations
cases, items and provenanceA case gathers signals, notes and evidence into a thread with an owner, a priority and a status. Evidence items keep their references back to the source objects, so a case reviewed six months later still answers 'where did this come from'.
Reports
typed sections, with citationsStructured reports whose sections are typed — narrative, entities, signals — and whose citations point at records rather than at other prose. A report is generated from the platform's state, so a figure in it and the dashboard tile it came from cannot disagree.
Dashboards
aggregates computed on readMetric, breakdown, trend and map widgets, each a query over the ingested objects with its own facet, filter and aggregation. Nothing is precomputed, so nothing goes stale, and a tile's number is always one click from the rows that produced it.
Alert rules
max · min · avg · count, per groupA rule watches one field of one source, grouped — per unit, per site, per device — and fires when the aggregate crosses a threshold. Rules are owner-scoped: a rule evaluates against exactly what its owner is allowed to see.
Every figure on this site was measured, including the ones in the screenshots
The findings in the captures below are not written copy. The seed that builds the AcmeRail fixture reads the ingested telemetry, computes the fleet's actual engine hours, peak coolant temperatures and minimum bus voltages, and composes the finding text from those numbers. If the fixture stopped producing the anomaly, the finding would change with it rather than becoming a lie the site keeps telling.
- Signal summaries interpolate measured aggregates, never hard-coded figures
- Each signal carries references to the knowledge objects it was drawn from
- The alert thresholds are set against the measured fleet, so the seeded stack ships with real firings rather than four rules that have never fired
- One locomotive breaches both the thermal and the electrical rule — the same unit the investigation case and the deep-dive report are about
The fixture is fiction — AcmeRail, its eight locomotives and its two vendors are invented — but the arithmetic is not. The figures in every finding are read from the ingested data at seed time.
A rule that fires is the start of the thread, not the end of it
An alert without a case is a notification somebody eventually stops reading. The platform's path runs the other way: the rule fires, the signal explains what was measured and what it implies, the case collects the evidence and assigns an owner, and the report is what leaves the building.
- Alert history keeps the observed value and the threshold beside each firing, so a rule that is too sensitive is visible as such
- Cases carry collaborators, tags, comments and an activity trail
- Reports can be generated from a case, and keep the link back to it
- Everything is org-scoped: one customer's findings are not another's to read
A report is a view of the platform's state, not a document beside it
A report's sections are typed and its citations point at records. That is what makes the figure in a report and the tile it came from unable to disagree: they are the same query, asked twice.
Bring a question you already argue about
The best demo of an analysis surface is a disagreement it can settle. Bring the number two teams report differently, and we will show you where each one comes from.