Get early access
Features · AI & Automation · Forensic Mode
AI & Automation · Forensic Mode

Replay the fleet,
second by second.

Pick a timestamp — anywhere in the last N days — and HostAtlas reconstructs what your fleet looked like at that moment. Services, ports, config, deploys, certificates, processes. The flight recorder you wish you had during last quarter's outage.

rewind · 2026-05-14 17:31
hosts online 46 of 47 yellowstone cpu 92% · mem 88% open incidents 1 · INC-2841 last deploy 17:04 · 27 min before config changed nginx.conf · 15:12
— Why this matters

Reconstructing an outage from four tabs is how details get lost.

01

The window is the unit, not the signal.

Pick a server and a time range and every signal in it assembles together — alerts, incidents, config events, anomalies, audit entries, logs.

02

It reads, it does not store.

Forensic Mode is an assembler over data you already have. No second copy, no retention policy of its own.

03

A URL is the shareable artifact.

Server, from and to live in the address, so "look at this window" is a link rather than a description.

— What's included

What a window shows.

Five range shortcuts
15 minutes to 7 days, or an explicit from and to in UTC.
Tabbed timeline
Alerts, incidents, config events, anomalies, audit entries and logs — separated, in the same window.
KPI strip and metric tiles
The at-a-glance read before you go digging.
Metric peaks as gauges
The high-water mark in the window, not a line you have to interpret.
Log excerpts in full
Rendered with whitespace preserved, because a truncated log line is not evidence.
Reachable from where you are
The server detail menu and the incident view both open straight into the right window.
— How it works

It reads history. It does not make any.

1

Pick a window

Five shortcuts or a custom range around the moment you care about.

2

Read what is already stored

Metrics, logs, config snapshots and command history are assembled for that window. Nothing extra is recorded to make this work.

3

Share the URL

The range lives in the address, so the reconstruction you are looking at is the one your colleague opens.

— Works with

Connected capabilities

Config Watch
The watched-file history Forensic Mode reads from.
→
Audit Log
Cross-references every action in the timeline.
→
Postmortems
Generates a Forensic snapshot for the incident window.
→
AI Triage
Uses Forensic snapshots to ground "what changed" answers.
→
— FAQ

Questions, answered honestly.

How far back can I go? +
30 days standard; 90 / 365 day options on Pro / Enterprise.
Does it work for hosts I added later? +
No — only for the period each host has been enrolled. Reasonable, since there was no agent to report.
Is the data tamper-proof? +
Snapshots are immutable + HMAC-signed; verifier in the UI. Useful for incident reports submitted externally.

Replay your fleet, not just your charts.

Forensic Mode currently in private beta; coming Pro + Enterprise.

Get early access Back to AI & Automation