Investigate
Console route · /observability
Observability (Telemetry Dual-Use)
Operational health derived from the same telemetry the detection engine already consumes — ingest throughput, connector uptime, pipeline lag, and silent-source detection — with no new agents and no new collection. Metrics come only from real production telemetry; synthetic and test provenance never inflate uptime.
Why this surface exists
Pure security is a grudge purchase: nobody wants to pay for something with no visible return. But every beacon that feeds the detection engine is also an operational signal. Observability re-projects the telemetry the platform already collects into an operational-health view, so the same spend produces visible operational value.
This is a read-only projection, not a second pipeline. It reasons over existing ingest, connector, pipeline, and detection-cursor records. There are no new agents to deploy and nothing is collected twice.
What it derives
Service health treats each configured connector, the ingest pipeline, and the detection engine as an operational service with a state (healthy, degraded, down, or idle), last-hour throughput versus the prior hour, ingest latency, and a per-hour sparkline. Silent-source detection flags an enabled connector that has gone quiet longer than its expected window — a beacon going dark is itself an operational signal.
Summary SLIs cover total events in the window, events per minute, ingest latency, pipeline lag and backlog, and normalized percentage. Only provenance real telemetry counts toward any of these numbers.
- Route: /observability (Investigate)
- Service Health: connector, pipeline, and detection services with state, throughput delta, latency, and sparkline
- Silent Sources: enabled connectors quiet beyond their window, each linking to Integrations
- Throughput: hourly event volume with high-severity overlay
- API: GET /v1/observability
Live, evaluation, and honesty
Like the rest of the console, Observability respects the demo/live toggle. Demo mode shows a labeled evaluation dataset so the surface is explorable before a connector is configured. Live mode derives everything from real telemetry and holds an honest empty state when a tenant has no connected source yet — it does not invent healthy services.
A connector service links to Integrations, the pipeline service to Command Center, and the detection service to Detection Engineering, so an operational anomaly routes straight to the surface that owns it.
Observability will read sparse until real telemetry flows — that is honest, not broken. It reports operational truth over the same custody path, never fabricated activity.