> For the complete documentation index, see [llms.txt](https://docs.kosmoslabs.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kosmoslabs.ai/product-documentation/understanding-results.md). # Understanding Results Kosmos analyzes your incident data to surface patterns and prevent recurring issues. Here's how to interpret what you see. ### Key Concepts #### Risk Events A **Risk Event** is Kosmos's machine-generated analysis of a pattern or anomaly that may indicate a systemic problem. Think of these as early warnings—signals that something in your delivery process needs attention. Risk Events are surfaced automatically when Kosmos identifies: * Recurring incident patterns * Correlation between deployments and issues * Unusual spikes or trends in your data **Not every Risk Event requires action.** Some may be expected (planned maintenance, known issues). You can dismiss Risk Events that aren't relevant, and Kosmos learns from your feedback. #### RCA Reports An **RCA Report** (Root Cause Analysis) is a **human-confirmed** analysis. When you review a Risk Event and determine it represents a real issue, you promote it to an RCA with one click. The underlying analysis is the same - promotion is a status change that marks it as the official record. **Why this distinction matters:** Machines propose. Humans confirm. Kosmos won't label something as an "official RCA" without your confirmation. This protects you from inaccurate automated outputs being treated as fact. You stay in control. RCA Reports include: * **Summary:** Plain-language explanation of what happened * **Correlated Evidence:** Linked commits, PRs, tickets, and cases * **Timeline:** Sequence of events leading to the issue * **Recommendations:** Suggested preventive actions *** ### Reading the Dashboard #### Risk Events View Risk Events are organized into tabs by status — **Inbox**, **Acknowledged**, and **Dismissed** — replacing the previous dropdown filter. Rows show the pattern, severity, first seen date, and occurrence count at a glance, with pill badges indicating severity and status. | Column | Meaning | | --------------- | ------------------------------------------------- | | **Status** | New, Acknowledged, Dismissed | | **Severity** | High, Medium, Low — based on frequency and impact | | **Pattern** | Description of what Kosmos detected | | **First Seen** | When this pattern first appeared | | **Occurrences** | How many times this pattern has repeated | **Actions you can take on a single Risk Event:** * **Acknowledge** — You're aware and investigating * **Promote to RCA** — Generate a full root cause analysis * **Dismiss** — Not relevant; Kosmos will learn from this **Bulk actions:** Select multiple Risk Events using the checkboxes to acknowledge, dismiss, or promote them in one action. *** #### Risk Event Detail Clicking a Risk Event opens the detail view, which uses a two-column grid layout: the main content area on the left, and a side rail with metadata and related signals on the right. **AI-generated summary:** Below the title, Kosmos displays a plain-language paragraph summarizing the correlation — signal count, deployment count, and the time window they occurred in. This is machine-generated and marked with a sparkles icon (✨). **Inline signals and deployments:** The side rail shows the specific signals and deployment cards linked to this Risk Event, so you can see the raw evidence without leaving the page. **Timeline:** A visual event timeline shows the sequence of signals and deployments in chronological order, helping you reconstruct what happened and when. **Sticky action bar:** A persistent bar at the bottom of the page keeps the primary actions (Acknowledge, Promote to RCA, Dismiss) accessible as you scroll through the evidence. **Explainability view:** Click **Explain correlation** from the detail page to open a side-by-side evidence view at `/risk-events/[id]/explain`. This shows the signal on the left, the deployment on the right, and a center column called "What was found" that lists the specific factors the engine matched on — shared issue keys, time proximity, token overlap, and more. Keywords that appear on both sides are highlighted so you can see exactly what the engine matched. Use this when you need to decide whether to trust a correlation before promoting it. *** #### RCA Report View Each RCA Report includes: **1. Executive Summary** A 2-3 sentence overview suitable for sharing with leadership. **2. Correlated Evidence** Kosmos links related data across your systems: * Jira issues that match the incident pattern * GitHub commits/PRs deployed near the incident time * Salesforce cases from affected customers **3. Root Cause Analysis** AI-generated analysis identifying likely causes, including: * What changed before the incident * Which systems or services were affected * Contributing factors (deployment timing, code changes, config updates) **4. Recommendations** Actionable next steps to prevent recurrence. #### RCA Actions Every action available on an RCA Report is collected in a single actions menu, replacing the row of buttons that previously ran across the top of the report. From the menu you can: * **Export PDF** — Download a formatted report for sharing outside Kosmos * **Export Markdown** — Download the RCA as a Markdown file for use in wikis, GitHub, or Notion * **Export Word** — Download a `.docx` version for stakeholder distribution * **Share** — Copy a link to share with team members * **Print** — Print directly from your browser * **Create Jira Ticket** — Create a follow-up ticket in Jira with the RCA details pre-filled **The menu reflects your connected integrations.** Actions that depend on an integration appear only when that integration is connected and configured for your organization. If your team has not connected Jira, for example, you will not see the option to create a Jira ticket. This keeps the menu limited to actions you can actually complete, so nothing in it leads to a dead end. When you create a Jira ticket from an RCA, the project dropdown lists only the projects you selected during Jira integration setup. Projects that exist in your Jira instance but were not selected for the integration do not appear, so a follow-up ticket cannot be filed into a project Kosmos was never connected to. To change which projects are available, update your selection in Settings → Integrations → Jira. *** ### Providing Feedback Your feedback helps Kosmos learn and improve. You can provide feedback at two levels: **Correlation Feedback** When viewing a correlation, you'll see "Is this correlation accurate?" with three options: * **Correct** — The correlation is valid * **Partial** — Some elements are correct, others aren't * **Wrong** — This correlation isn't meaningful **RCA Feedback** After reviewing an RCA, you can rate: * Was the root cause accurate? * Were the recommendations helpful? * If inaccurate, what was the actual root cause? This feedback feeds into Kosmos's calibration engine. Over time, the system learns your environment's patterns and produces more accurate results. *** ### The Correlation Engine Kosmos's key differentiator is **correlation** - connecting three types of signals that don't speak the same language: * **Customer cases** - Salesforce cases, Zendesk tickets describing symptoms * **Code changes** - Jira tickets, GitHub commits, PRs, deployments * **Service incidents** - Logs, traces, metrics from your infrastructure (Preview) **Example:** > A customer reports an issue in Salesforce. Kosmos correlates this case with a Jira bug logged the same day and a GitHub deployment 2 hours prior. The RCA shows the deployment introduced a regression affecting that customer's use case. This cross-system visibility is what enables prevention, not just faster response. *** ### The Correlation Library The **Correlation Library** is a research-oriented view of every cluster the correlation engine has surfaced across your signals and deployments. It is not an action queue — it exists for investigation and context. If you're looking for something to act on, start with Risk Events instead. The library is organized with a filter bar at the top: time window tabs (Last 7 days, Last 30 days, Last 90 days, All time), a system filter, and a score threshold filter. Each row shows the correlation score prominently, along with the title, time range, signal and deployment counts, and which systems are involved. Correlations are divided into **strong** (≥ 50% confidence) and **weak** (< 50% confidence) by a visual separator. Weak correlations are shown in a muted style with a note that no action is recommended. The engine recalculates these clusters automatically as new signals arrive — you don't manage them directly. #### Deployment Timeline When viewing a Risk Event or RCA, you'll see a visual timeline showing deployments that occurred within ±8 hours of the incident. This helps you quickly identify which releases may have contributed to the issue. The timeline shows: * Your incident at the center * Deployments before and after, with version labels * Time delta between each deployment and the incident * Confidence indicators: High (green), Medium (yellow), Low (gray) Click any deployment marker to see details including version name, release time, change type, and related issues. Use the sort control in the timeline header to switch between newest-first (the default) and oldest-first ordering—useful when you're tracing back to a root cause versus triaging what just happened. You can also switch the timeline to a vertical layout. This can make dense timelines with many closely-spaced events easier to scan. #### Correlation Scores Each correlation displays a percentage score. Click the **ℹ️** icon next to any score to see how it was calculated. Kosmos weights multiple factors: * **Time proximity** — How close the events occurred * **System/entity match** — Same service or component affected * **Issue keys** — Matching ticket references (e.g., KOS-123) * **Text similarity** — Similar descriptions or error messages * **Component overlap** — Shared file paths or services * **Author/assignee match** — Same person involved * **PR number match** — Linked pull requests * **Error pattern family** — Similar error types Higher scores mean more factors aligned. A 25% score typically indicates a single weak match (like text similarity alone), while 70%+ means multiple strong signals converged. #### Evidence Breakdown Each correlation shows *why* Kosmos thinks two events are related. Hover or click on any correlation to see the evidence breakdown: * Which signals contributed to the match * The reasoning behind the correlation * Confidence level for each factor For a deeper view, use the **Explainability** page (see Risk Event Detail above), which shows the full side-by-side evidence for a specific Risk Event. This transparency helps you trust and explain the analysis to stakeholders. *** ### What "Preventative Intelligence" Means Kosmos reduces MTTR **and** prevents incidents from recurring: 1. **Reducing investigation time** - Structured root cause in under 60 seconds, not 2-4 hours 2. **Correlating deployments** with downstream customer cases and incidents 3. **Building organizational memory** - Every confirmed RCA is searchable, so the next on-call doesn't start from zero The goal: fewer incidents, not just faster fixes. *** ### Questions About Your Results? Your Kosmos team will walk you through your initial Historical Baseline findings. If you have questions between scheduled calls, reach out to your dedicated contact or email .