Incident Similarity Engine matches a fresh incident against your incident archive. It surfaces the top 3 past incidents with similar signals and shows what fixed them. The on-call engineer (or the responding agent) sees "this looks like inc-4502 from last quarter, these three steps resolved it." Most incidents have ancestors; the engine finds them.
Each incident gets a signature: the symptom signature (which SLIs breached, which signals fired, in what order) and the service signature (which services were involved, how the service-graph cluster looked). Matching compares the live incident's signature against archived ones using both signatures jointly. Top 3 matches over a confidence threshold are surfaced.
For each match, the engine extracts the resolution path (what tools, in what order, with what outcome). The top match's resolution is offered as a starting suggestion. The on-call engineer sees the suggestion and the data behind it; choosing it is one click; ignoring it is also one click. The system never forces a path.
Not every incident has a clear past match. The page reports match coverage (percent of incidents with a confident match) and trend. Match coverage typically grows over time as the archive grows. New tenants start with low coverage; mature tenants see 70%+ match rates within a year.
Similarity matching is strictly per-tenant. Your incident archive is your archive; another tenant's incidents never appear in your match results. Aggregate model improvements that benefit everyone are derived only from anonymized signature shapes, never raw incident data.
Subscribe to Nova AI Ops on YouTube for demos, tutorials, and feature deep-dives.
Generic runbooks miss what makes your environment yours. Similarity Engine pulls fixes from your own track record.