Skip to main content
An Insight is RubixKube’s answer to the question “what should I look at right now?” It is an anomaly significant enough that a human should be aware of it, surfaced with the evidence behind it and the resources it affects. Insights are not alerts. Alerts fire on thresholds humans set. Insights surface on baselines the system learns. Threshold alerts train people to ignore them; learned baselines produce far less noise.

​
What makes an Insight

Learned baseline

Each resource has a baseline the system builds over time. Insights surface when a signal drifts outside that baseline.

Severity

Low, Medium, High, Critical. Scored against blast radius, trend, and prior art.

Cited evidence

Every claim on an insight links back to the signal it came from. Verification is a click away.

Scope

An insight always names the affected resources and the environment they live in. No ambiguity.

​
How Insights differ from alerts

AspectTraditional alertRubixKube Insight
TriggerStatic thresholdLearned baseline
TuningManual, per ruleAutomatic, per resource
NoiseHigh over timeDrops as baselines mature
ContextSingle metricCross-signal with blast radius
Follow-throughRequires a human to correlateAutomatically links to RCA when one applies

​
The Insight lifecycle

1

Open

A signal crosses the learned band. An Insight card opens in Magic Insights. Subscribers get notified on the channels you configured.
2

Investigate

If the signal shape warrants a full causal analysis, the RCA Pipeline starts. The insight gains an attached RCA report when it is ready.
3

Act

Either from the RCA’s recommended actions, or by routing the insight to Chat, Slack, Teams, Linear, or PagerDuty for human follow-up.
4

Close

When the underlying signal returns to baseline, the insight closes automatically. Resolution notes, if any, are stored in the Memory Engine for future matches.

​
Severity, and how it is set

Severity is not a single number. Four inputs blend into the score.
How far outside the baseline the signal is, normalised per metric.
How many dependent resources are affected (or likely to be) based on the graph.
Worsening drifts score higher than stable ones. Flat drifts score lower than worsening ones.
If a similar pattern has caused real incidents before, the severity reflects that history.

​
What to do with an Insight

Read

Open the card. Skim the observed signals and the attached resources. Thirty seconds.

Investigate

Open in Chat if you want to interrogate further. The session starts with the insight’s context preloaded.

Route

Escalate to a teammate, PagerDuty, or a Linear ticket. Each route preserves the evidence trail.

Dismiss

If it is a known false positive, dismiss with a reason. The system learns from the reason.

​
Common questions

Usually one of three reasons. The baseline has not matured yet (give it a week of traffic). The drift is inside the learned noise band. Or the insight was deduplicated into an already-open one for the same resource.
Yes. Mute specific resources or namespaces through the console. Muted resources still stream signals, they just do not produce notifications.
Most drifts surface within one to two minutes of the underlying signal. The OPEL loop runs continuously, not on a fixed cron.
No. An insight is any anomaly worth a human look. An RCA Report is a full causal chain. Incidents without a single identifiable root cause stay as insights.

Root Cause Analysis

How insights turn into full causal chains.

Magic Insights in the console

The console view where insights live.