The evidence is already attached
By the time you open the incident, the investigation has already happened.
The usual sequence is: get paged, open a dashboard, guess which metric matters, pick a time range, discover the interesting second fell between samples. Ten minutes gone before you have a hypothesis.
Instead, the moment risk crosses a floor the flight recorder flushes its window: five minutes of per-second state, 300 frames, no gaps. The process tree responsible is resolved at flush time, walking up to 32 levels of parentage — while those processes are still alive to name. A crash cannot erase who caused it.
Cluster events from the same minutes are joined automatically, so a pod eviction that coincided with the failure is on the same timeline rather than in a different tool with a different clock. Diagnosis becomes reading rather than reconstructing.
Defaults at this stage
- recorder window
- 5 min · 300 frames
- process tree
- up to 32 levels
All six stages, on every plan with agents.
Detection through post-mortem in one system. No second vendor for paging.
Deploy an agent→