ML-Assisted Incident RCA

Tools that surface candidate root causes during incidents — pattern matching to past incidents, change correlation, dimension surfacing, LLM-based summarization. Honest read on what works (correlation finders, runbook search) versus what is overclaimed marketing (true causal RCA). The engineer is still doing the actual root-cause reasoning.

Overview

Candidate surfacing, not root cause proof

"Root cause analysis" is the most overclaimed phrase in AIOps marketing. The tools sold as RCA systems are more accurately candidate-surfacing systems: they speed up human investigation by bringing relevant signals forward, and they make some candidates more likely than others. They do not prove causation.

The five capabilities behind "ML-assisted RCA"

Pattern matching to past incidents — Searches incident history for similar fingerprints (affected services, alert types, error patterns) and surfaces the closest matches with their runbooks
Change correlation — Finds deploys, config changes and feature-flag flips in the window before anomaly onset
Dimension surfacing — Finds which attribute combinations (region, user agent, feature flag, customer tier) differ between failing and healthy requests
Causal graph traversal — Walks a real-time service topology upstream from anomalous nodes to the root entity with no healthy upstream
LLM-based summarization — Reads the alert and log stream and writes a plain-English incident narrative

Why "RCA" is misleading

Temporal correlation — A happened near B — That A caused B
Topology path — A calls B — That A's change caused B's degradation
Dimension difference — The failing requests all have flag X — That no confounder explains it; it narrows the search space only

> [!WARNING] Treating tool output as a conclusion rather than a hypothesis is the failure mode. Rolling back deploy X without validation may fix the wrong thing, or start a new incident by reverting an unrelated deploy.

Interview questions

Walk me through how you would use ML-assisted RCA tools to investigate a P1 incident step by step.
How does Dynatrace Davis differ from Datadog Watchdog Insights for root cause assistance?
How would you implement a systematic post-incident review process that improves RCA tool accuracy over time?
When does causal inference (DoWhy, Bayesian networks) add value over standard correlation-based RCA?
How do you handle the failure mode where engineers over-rely on RCA tools and stop doing independent investigation?