Automating root cause analysis at scale: Multi-signal correlation for cloud native incident responseSantosh Balaranganathan and colleagues at Atlassian describe their automated root cause analysis system that treats incident diagnosis as a correlation problem across three dimensions: signal type (metrics, logs, traces), time, and service topology. The pipeline scopes the search using OpenTelemetry-derived dependency graphs, detects anomalies independently per signal, temporally aligns co-occurring anomalies into bundles, traverses the graph to determine causal direction, and emits ranked hypotheses with human-readable narratives so responders can validate and act quickly.
- Sequence fingerprinting collapses repeated fault patterns (the same upstream timeout replaying every few seconds) into a single bundle with a replay count, preventing dozens of identical hypotheses from obscuring the signal.
- The team found statistical methods (MAD, percentile bands) work well enough for metrics anomaly detection and are far easier to debug than ML models; they reserve ML for log clustering and trace structural analysis.
- The system is being extended with LLM-based orchestration to make RCA iterative—an agent can request additional telemetry, refine hypotheses, and adapt its investigation strategy across multiple steps rather than running one-shot.
- A shared incident context anchors all signals, hypotheses, and actions per incident, feeding both a faulty-service pager that pages the right team early and an LLM-powered copilot that recommends mitigations (rollbacks, feature flag disablement) grounded in the actual diagnosis.
- Sequence fingerprinting collapses repeated fault patterns (the same upstream timeout replaying every few seconds) into a single bundle with a replay count, preventing dozens of identical hypotheses from obscuring the signal.
- The team found statistical methods (MAD, percentile bands) work well enough for metrics anomaly detection and are far easier to debug than ML models; they reserve ML for log clustering and trace structural analysis.
- The system is being extended with LLM-based orchestration to make RCA iterative—an agent can request additional telemetry, refine hypotheses, and adapt its investigation strategy across multiple steps rather than running one-shot.
- A shared incident context anchors all signals, hypotheses, and actions per incident, feeding both a faulty-service pager that pages the right team early and an LLM-powered copilot that recommends mitigations (rollbacks, feature flag disablement) grounded in the actual diagnosis.
This article explores how prompt engineering can be used to improve time-series analysis with Large Language Models (LLMs), covering core strategies, preprocessing, anomaly detection, and feature engineering. It provides practical prompts and examples for various tasks.
Article discusses a study at MIT Data to AI Lab comparing large language models (LLMs) with other methods for detecting anomalies in time series data. Despite losing to other methods, LLMs show potential for zero-shot learning and direct integration in deployment, offering efficiency gains.
Learn how to use Autoencoders to detect anomalies in time series data in a few lines of code.
MIT researchers have developed a framework using large language models (LLMs) to efficiently detect anomalies in time-series data from complex systems like wind farms or satellites, potentially flagging problems before they occur.
Stumpy is a Python library designed for efficient analysis of large time series data. It uses matrix profile computation to identify patterns, anomalies, and shapelets. Stumpy leverages optimized algorithms, parallel processing, and early termination to significantly reduce computational overhead.
This article explains the importance of data validation in a machine learning pipeline and demonstrates how to use TensorFlow Data Validation (TFDV) to validate data. It covers the 5 stages of machine learning validation: generating statistics from training data, inferring schema from training data, generating statistics for evaluation data and comparing it with training data, identifying and fixing anomalies, and checking for drifts and data skew.
The article discusses the challenges faced in evaluating anomaly detection in time series data and introduces Proximity-Aware Time series anomaly Evaluation (PATE) as a solution. PATE provides a weighted version of Precision and Recall curve and considers temporal correlations and buffer zones for a more accurate and nuanced evaluation.
