cross-source-correlation

name	cross-source-correlation
description	Correlate near-in-time events across PR merges, deploys, monitoring (Sentry/NewRelic/Datadog/AppDynamics) and ticket trackers (Jira/Azure DevOps) into confidence-scored clusters that answer "which deploy caused this bug" without manual tab-switching.
tags	["observability","incident-response","correlation","ai-agent","devops"]
publisher	agena

Cross-Source Correlation

When a Sentry alert fires, a senior engineer mentally cross-references the last deploy time, recent PRs, NewRelic apdex, and the support tickets opened in the last hour. AGENA's Cross-Source Correlation engine does the same correlation deterministically, producing a single confidence-scored cluster per incident.

How to apply this pattern

1. Pick a time window (default 60 minutes ending now) and pull every event your platform observed inside it: PR merges, deploys, error imports (Sentry / NewRelic / Datadog / AppDynamics), and work-item imports (Jira / Azure DevOps).

2. Score candidate clusters using a heuristic that rewards co-location in time + repo:

   • PR merge inside the window → +40
   • Deploy from the same repo inside the window → +20
   • One monitoring signal in the window → +20 (+30 if more than one)
   • One work-item opened in the window → +10 (+20 if more than one)
   • Bonus +10 when a PR is present alongside any monitoring signal

3. Surface only clusters ≥ 70. Below that the noise / signal ratio collapses; above it you get the "vay" moment for incident triage.

4. Persist the cluster with: primary_kind, primary_label, related_events[], confidence, severity, narrative, repo_mapping_id. Keep a fingerprint for idempotency so repeated poller runs don't double-insert the same cluster.

5. Offer triage actions on each cluster: confirm, false-positive, undo, and (when a PR is the prime suspect) one-click rollback.

Example

🔴 CRITICAL · confidence 94%

PR #4519 (erinc, merged 14:18) in checkout-api correlates with
2 monitoring signal(s) (sentry, newrelic) and 1 work-item opened
in the same window.

Timeline:
  14:18  🔀 PR #4519 merged — payment_service.py, +47/-12
  14:18  🚀 deploy a1b2c3d4 → production
  14:23  🚨 Sentry: TypeError in payment_service.py:88 (47×)
  14:24  📡 NewRelic: apdex 0.92 → 0.41
  14:31  🪐 Jira SUP-128 opened — 12 customers report failed checkout

Notes

• Run as a background poller every ~5 minutes on a fresh window — no webhook fan-out needed when you control all the sources.
• Sub-70 clusters can still be useful for trending dashboards even if you don't want to surface them as actionable.
• Store the cluster's narrative as a one-sentence summary (LLM-generated off the timeline) so it's readable in Slack alerts and post-mortem docs.
• Designed to be agnostic to specific monitoring backends — add a new source by writing a single mapper that emits (timestamp, kind, ref, label) rows into the same window query.