Platform

From signal to decision in one pipeline

Cordant connects to your existing observability stack and runs a continuous diagnosis loop: detect anomaly, trace root cause, scope impact, propose fix. Engineers receive a ready-to-act decision brief, not a wall of alerts.

Step 1: Detect

Signal ingestion and anomaly scoring

Cordant subscribes to metrics, logs, traces, and deployment events from your existing tools. A streaming anomaly scorer compares current signal patterns against a rolling baseline, flagging deviations by severity and rate-of-change rather than fixed thresholds. No alert rules to write.

  • Reads from Datadog, Prometheus, CloudWatch, PagerDuty, and your CI/CD pipeline without agents or sidecars
  • Adaptive baseline per service, time-of-day, and traffic segment so Monday 9am and Saturday 3am have separate normal bands
  • Correlated multi-signal scoring: a p99 spike alone scores low, but p99 spike plus error rate climb plus a recent deploy scores high
Diagram showing Cordant signal ingestion flow from Datadog, Prometheus, and CloudWatch converging into the anomaly scorer. Sample data.

Step 2: Diagnose

Causal graph traversal and root-cause isolation

Once an anomaly clears the scoring threshold, Cordant builds a causal subgraph: which upstream services degraded first, which deployments touched these paths in the last 72 hours, which config changes correlate in time. The engine ranks candidate root causes by posterior probability, not by who filed the alert.

Sample diagnosis output 
// Incident: checkout service p99 latency +340%: 2025-09-04 02:17 UTC

Root cause (87% confidence)
  postgres-primary: connection pool exhaustion
  trigger: deploy [email protected] (2025-09-03 23:48 UTC)
    → added N+1 query pattern in /checkout/confirm handler

Corroborating signals:
  db.pool.waitTime p99  : 12ms → 4,200ms  (+35000%)
  db.connections.active : 98/100 pool slots occupied
  svc.checkout.errors   : 0.0% → 6.4%

Affected paths:
  /checkout/confirm  (100% of traffic)
  /order/status      (reads same pool, secondary impact)

Illustrative: sample data

Step 3: Remediate

Scoped action proposals with one-click runbooks

If a diagnosed fix is within your approved runbook and policy scope, Cordant executes it autonomously, with no pager, and logs the action for audit. If it exceeds policy bounds or the confidence threshold, Cordant generates a ranked action brief and routes it to on-call for approval before execution.

Sample remediation brief: Illustrative
1
Rollback kdx-api to v2.4.0
Estimated resolution: immediate. Blast radius: none. Rollback path: re-deploy v2.4.1 after query fix lands.
Recommended
2
Increase connection pool max to 150 temporarily
Buys headroom while hotfix is prepared. Requires postgres-primary config restart (30s interruption).
Alternative

Step 4: Escalate selectively

Wake a human only when a decision is required

Cordant escalates to your on-call rotation only when it reaches a confidence threshold or determines that the required remediation step needs human authorization. The escalation payload is the full diagnosis brief, not a raw alert. Engineers wake to a decision, not a mystery.

Noise suppressed
Low-confidence or self-resolving anomalies are logged and closed without paging anyone
Full brief on page
Root cause, corroborating signals, affected paths, and ranked action options arrive with the alert
Approve and execute
One-tap approval triggers Cordant to run the approved runbook steps via your existing tooling

Put approved remediation on autopilot

Connect Cordant to your observability stack in a day via API, with no agents or instrumentation changes.

Request Access Talk to the team