Stop reading three pages of dashboards to find out it's the same disk filling. AI Triage groups noisy symptoms, ranks by real impact, attaches the evidence — and points at the change that broke things.
Disk on /var reached 94 %, postgres started fsync-stalling, that's your p95 latency climb on api-prod, then 5xx propagated to upstream uptime probes. The backup-age alert is the same root: nightly dump can't complete with 6 % free.
Each mode answers a different question. None of them answer with vibes — every conclusion is anchored in evidence pulled from the same sources you'd read manually.
Multiple firing alerts → one ranked incident. Severity grading from real impact (user-facing 5xx beats free-disk warning), not metric thresholds.
Natural-language query against logs, metrics, recent deploys, config diffs. The output cites which lines and which time-windows were used.
Replay fleet state at any timestamp. See what was running, what changed, what alerted in the half hour before things broke. The data already exists — we're building the UI that overlays it on a chosen window.
AI Explain is a button on the page you're looking at — server, domain, incident, attack timeline. Modal opens, evidence is gathered, summary lands. No leaving context.
Status, recent changes, current saturation, plugin signals — synthesized in one sweep.
DNS chain, CDN posture, certificate origin/edge mismatch, monitor history — collated.
Post-attack analysis writes the summary you'd otherwise put together with grep and patience.
Any OpenAI-compatible endpoint works. Your key, your provider, your data plane. We don't hold a model hostage behind a paywall.
Triage, root cause, forensic — same evidence, three modes.