Skip to main content
An Organization is the tenant boundary. A User holds at most one current Membership, with an Admin, Editor, or Viewer Role. Authentication resolves that Membership rather than accepting an Organization during sign-in. An Integration is one configured source. It currently offers bounded observation/read Tools or accepts authenticated Alert Events. A Relay performs closed Kubernetes reads from inside the customer boundary and opens an outbound session to the control plane.

​
How the records relate

An Alert Event is one normalized alert occurrence. Redelivery is idempotent, and the source timestamp remains distinct from receipt time. Alert Events create or update a provisional Incident using the alert source’s grouping identity. The Incident remains firing while any grouped Alert Event is firing and resolves when none are firing. Grouping is not a causal claim. Three Alert Events with one Alertmanager grouping key can belong to one Incident even when they have different causes. Review grouping before treating the Incident as one causal episode. A person investigates an Incident inside a Conversation. Each Message opens one bounded, immutable Investigation. Its numbered Tool Runs support cited Findings and Action Proposals. After the Incident resolves, a person may generate and review its draft Postmortem. For example, an Alertmanager delivery creates an Alert Event and Incident. A Kubernetes Integration supplies evidence through Relay; GitHub supplies change evidence. OpenCluster cites those reads but does not execute the proposed rollback. Organization membership limits every product record and Tool. Provider permissions, source time windows, budgets, truncation, and missing telemetry limit what an Investigation can conclude. Continue with Investigations and results or connect your tools.