Understanding Results
How to interpret Risk Events and RCA Reports
Kosmos analyzes your incident data to surface patterns and prevent recurring issues. Here's how to interpret what you see.
Key Concepts
Risk Events
A Risk Event is Kosmos's machine-generated analysis of a pattern or anomaly that may indicate a systemic problem. Think of these as early warnings—signals that something in your delivery process needs attention.
Risk Events are surfaced automatically when Kosmos identifies:
Recurring incident patterns
Correlation between deployments and issues
Unusual spikes or trends in your data
Not every Risk Event requires action. Some may be expected (planned maintenance, known issues). You can dismiss Risk Events that aren't relevant, and Kosmos learns from your feedback.
RCA Reports
An RCA Report (Root Cause Analysis) is a human-confirmed analysis. When you review a Risk Event and determine it represents a real issue, you promote it to an RCA with one click. The underlying analysis is the same - promotion is a status change that marks it as the official record.
Why this distinction matters: Machines propose. Humans confirm. Kosmos won't label something as an "official RCA" without your confirmation. This protects you from inaccurate automated outputs being treated as fact. You stay in control.
RCA Reports include:
Summary: Plain-language explanation of what happened
Correlated Evidence: Linked commits, PRs, tickets, and cases
Timeline: Sequence of events leading to the issue
Recommendations: Suggested preventive actions
Reading the Dashboard
Risk Events View
Risk Events are organized into tabs by status — Inbox, Acknowledged, and Dismissed — replacing the previous dropdown filter. Rows show the pattern, severity, first seen date, and occurrence count at a glance, with pill badges indicating severity and status.
Status
New, Acknowledged, Dismissed
Severity
High, Medium, Low — based on frequency and impact
Pattern
Description of what Kosmos detected
First Seen
When this pattern first appeared
Occurrences
How many times this pattern has repeated
Actions you can take on a single Risk Event:
Acknowledge — You're aware and investigating
Promote to RCA — Generate a full root cause analysis
Dismiss — Not relevant; Kosmos will learn from this
Bulk actions: Select multiple Risk Events using the checkboxes to acknowledge, dismiss, or promote them in one action.
Risk Event Detail
Clicking a Risk Event opens the detail view, which uses a two-column grid layout: the main content area on the left, and a side rail with metadata and related signals on the right.
AI-generated summary: Below the title, Kosmos displays a plain-language paragraph summarizing the correlation — signal count, deployment count, and the time window they occurred in. This is machine-generated and marked with a sparkles icon (✨).
Inline signals and deployments: The side rail shows the specific signals and deployment cards linked to this Risk Event, so you can see the raw evidence without leaving the page.
Timeline: A visual event timeline shows the sequence of signals and deployments in chronological order, helping you reconstruct what happened and when.
Sticky action bar: A persistent bar at the bottom of the page keeps the primary actions (Acknowledge, Promote to RCA, Dismiss) accessible as you scroll through the evidence.
Explainability view: Click Explain correlation from the detail page to open a side-by-side evidence view at /risk-events/[id]/explain. This shows the signal on the left, the deployment on the right, and a center column called "What was found" that lists the specific factors the engine matched on — shared issue keys, time proximity, token overlap, and more. Keywords that appear on both sides are highlighted so you can see exactly what the engine matched. Use this when you need to decide whether to trust a correlation before promoting it.
RCA Report View
Each RCA Report includes:
1. Executive Summary A 2-3 sentence overview suitable for sharing with leadership.
2. Correlated Evidence Kosmos links related data across your systems:
Jira issues that match the incident pattern
GitHub commits/PRs deployed near the incident time
Salesforce cases from affected customers
3. Root Cause Analysis AI-generated analysis identifying likely causes, including:
What changed before the incident
Which systems or services were affected
Contributing factors (deployment timing, code changes, config updates)
4. Recommendations Actionable next steps to prevent recurrence.
RCA Actions
Every action available on an RCA Report is collected in a single actions menu, replacing the row of buttons that previously ran across the top of the report.
From the menu you can:
Export PDF — Download a formatted report for sharing outside Kosmos
Export Markdown — Download the RCA as a Markdown file for use in wikis, GitHub, or Notion
Export Word — Download a
.docxversion for stakeholder distributionShare — Copy a link to share with team members
Print — Print directly from your browser
Create Jira Ticket — Create a follow-up ticket in Jira with the RCA details pre-filled
The menu reflects your connected integrations. Actions that depend on an integration appear only when that integration is connected and configured for your organization. If your team has not connected Jira, for example, you will not see the option to create a Jira ticket. This keeps the menu limited to actions you can actually complete, so nothing in it leads to a dead end.
When you create a Jira ticket from an RCA, the project dropdown lists only the projects you selected during Jira integration setup. Projects that exist in your Jira instance but were not selected for the integration do not appear, so a follow-up ticket cannot be filed into a project Kosmos was never connected to. To change which projects are available, update your selection in Settings → Integrations → Jira.
Providing Feedback
Your feedback helps Kosmos learn and improve. You can provide feedback at two levels:
Correlation Feedback When viewing a correlation, you'll see "Is this correlation accurate?" with three options:
Correct — The correlation is valid
Partial — Some elements are correct, others aren't
Wrong — This correlation isn't meaningful
RCA Feedback After reviewing an RCA, you can rate:
Was the root cause accurate?
Were the recommendations helpful?
If inaccurate, what was the actual root cause?
This feedback feeds into Kosmos's calibration engine. Over time, the system learns your environment's patterns and produces more accurate results.
The Correlation Engine
Kosmos's key differentiator is correlation - connecting three types of signals that don't speak the same language:
Customer cases - Salesforce cases, Zendesk tickets describing symptoms
Code changes - Jira tickets, GitHub commits, PRs, deployments
Service incidents - Logs, traces, metrics from your infrastructure (Preview)
Example:
A customer reports an issue in Salesforce. Kosmos correlates this case with a Jira bug logged the same day and a GitHub deployment 2 hours prior. The RCA shows the deployment introduced a regression affecting that customer's use case.
This cross-system visibility is what enables prevention, not just faster response.
The Correlation Library
The Correlation Library is a research-oriented view of every cluster the correlation engine has surfaced across your signals and deployments. It is not an action queue — it exists for investigation and context. If you're looking for something to act on, start with Risk Events instead.
The library is organized with a filter bar at the top: time window tabs (Last 7 days, Last 30 days, Last 90 days, All time), a system filter, and a score threshold filter. Each row shows the correlation score prominently, along with the title, time range, signal and deployment counts, and which systems are involved.
Correlations are divided into strong (≥ 50% confidence) and weak (< 50% confidence) by a visual separator. Weak correlations are shown in a muted style with a note that no action is recommended. The engine recalculates these clusters automatically as new signals arrive — you don't manage them directly.
Deployment Timeline
When viewing a Risk Event or RCA, you'll see a visual timeline showing deployments that occurred within ±8 hours of the incident. This helps you quickly identify which releases may have contributed to the issue.
The timeline shows:
Your incident at the center
Deployments before and after, with version labels
Time delta between each deployment and the incident
Confidence indicators: High (green), Medium (yellow), Low (gray)
Click any deployment marker to see details including version name, release time, change type, and related issues.
Use the sort control in the timeline header to switch between newest-first (the default) and oldest-first ordering—useful when you're tracing back to a root cause versus triaging what just happened.
You can also switch the timeline to a vertical layout. This can make dense timelines with many closely-spaced events easier to scan.
Correlation Scores
Each correlation displays a percentage score. Click the ℹ️ icon next to any score to see how it was calculated.
Kosmos weights multiple factors:
Time proximity — How close the events occurred
System/entity match — Same service or component affected
Issue keys — Matching ticket references (e.g., KOS-123)
Text similarity — Similar descriptions or error messages
Component overlap — Shared file paths or services
Author/assignee match — Same person involved
PR number match — Linked pull requests
Error pattern family — Similar error types
Higher scores mean more factors aligned. A 25% score typically indicates a single weak match (like text similarity alone), while 70%+ means multiple strong signals converged.
Evidence Breakdown
Each correlation shows why Kosmos thinks two events are related. Hover or click on any correlation to see the evidence breakdown:
Which signals contributed to the match
The reasoning behind the correlation
Confidence level for each factor
For a deeper view, use the Explainability page (see Risk Event Detail above), which shows the full side-by-side evidence for a specific Risk Event. This transparency helps you trust and explain the analysis to stakeholders.
What "Preventative Intelligence" Means
Kosmos reduces MTTR and prevents incidents from recurring:
Reducing investigation time - Structured root cause in under 60 seconds, not 2-4 hours
Correlating deployments with downstream customer cases and incidents
Building organizational memory - Every confirmed RCA is searchable, so the next on-call doesn't start from zero
The goal: fewer incidents, not just faster fixes.
Questions About Your Results?
Your Kosmos team will walk you through your initial Historical Baseline findings. If you have questions between scheduled calls, reach out to your dedicated contact or email support@kosmoslabs.ai.
Last updated
Was this helpful?