Cross-Signal Correlation joins the four pillars of observability into a single root-cause view. When an incident fires, Nova builds a graph: which traces are slow, which logs spike, which metrics broke, which deploy or change shipped, and how they connect. The graph answers "why" without you running five queries.
Nova builds a graph of signals around each incident. Nodes are concrete things: a trace span, a log spike, a metric breach, a deploy event. Edges are statistically-validated relationships: this log spike happened in the same trace as that slow span, this deploy preceded that metric breach, this metric broke during that change window. The graph is the explanation.
The graph is too dense to read directly. Nova surfaces the top three suspect nodes, each with a confidence score and a one-sentence explanation: "this deploy preceded the regression by 4 minutes, on the same service, with no other suspect changes in the window." If the top suspect is wrong, you have the next two ready, and a way to drill into the full graph.
Multi-tenant deployments must not let one tenant's correlation graph see another tenant's signals. Nova tags every signal with org_id and the correlation engine filters by tenant before it builds the graph. The graph builder is unit-tested against tenant-confusion attacks weekly. Audit-mode runs cross-tenant probes and reports zero leakage.
During an incident, the graph is live: nodes appear as new signals arrive, edges form as the correlation engine confirms relationships. After the incident, the graph is frozen and archived. The postmortem builder consumes the frozen graph directly so the timeline you write up is the timeline that actually happened, not a reconstruction.
Subscribe to Nova AI Ops on YouTube for demos, tutorials, and feature deep-dives.
Correlation is the work of root-cause analysis. We do the work; you get the answer.