Pick a scenario above.
Start with S1: a security-group rule is revoked and four alerts fire at once.
Most likely root cause
Proposed fix
Nothing runs until a person approves it.
Graph evidence
DEPENDS_ON
RUNS_ON · PROTECTS
ALLOWS_FROM
broken path · removed rule
alerting
top suspect
Drawn from the graph as it is now; rules restored since the incident show as active again.
Scorecard
Every candidate the graph surfaced, scored on evidence.
score = 3·coverage + 2·unhealthy − 2·healthy + 2·broken path + 2·change + 1·memory − 0.25·hops. Heuristic weights, tested on S1–S5.
Tool trace
Every step is a fixed Cypher query or fixed PromQL. Open a row to see it.