Platform
An investigation is a saved record for one problem: the services involved, a timeline, notes and a hypothesis. Onyx opens one when a rule raises a critical incident or a critical finding appears, and you can open one yourself.
AIOps compares the last five minutes with the hour before and lists failed requests, slower responses, error groups, deploys and bursts of error logs, each with a risk score from 0 to 100. It is rule-based and names no cause.
Open an investigation and the traces, logs and failing requests are read from telemetry at that moment. Nothing is copied into the record.
Each record has a severity, a status from Open to Closed, an owner and notes. Anyone on the team can see where it stands.
A critical incident from a rule, or a critical AIOps finding, opens an investigation. If one for the same service opened in the last 30 minutes, the new signal joins it.
Write notes, set a hypothesis, change the severity, and keep the services involved in view.
Move it to Resolved and then Closed when the work is done.
Let the record collect it as you go.