The data behind the shift — alerts, topology and measured accuracy.
Alert correlation and first-line triage for a systematic trading operation.
Alerts per minute across the window. The burst is the incident.
One mark per alert, one lane per service. Lanes are ordered by dependency depth — upstream at the top — so a cascade reads downward.
| Time | Sev | Service | Message |
|---|
What the desk actually works: one cause, many symptoms.
An edge A → B means A depends on B, so B is upstream.
Blast radius is how many services sit downstream of each node — the prior that
makes root-cause ranking possible.
| Service | Tier | Depends on | Blast radius |
|---|
Accuracy against seeded ground truth. Because the faults are injected, the true root and true incident membership of every alert is known.