Knowledge Discovery Engine (KDE)
KDE groups symptoms under an initiating cause and calculates downstream impact using the WanAware Relationship Graph, so teams can act without rebuilding context by hand.
What You’ll See in the Free Trial
In your environment, you should be able to confirm that KDE can:
- Identify one initiating cause behind related symptoms
- Show which downstream services are affected
- Show the dependency path behind the conclusion
- Update conclusions as conditions change
What the Knowledge Discovery Engine Does
KDE evaluates signals against the Relationship Graph to produce explainable conclusions: what changed, what failed first, what it affects, and what to do next.
KDE Continuously
- Classifies assets and signals so analysis starts with the right context
- Learns normal behavior with adaptive baselines
- Detects anomalies and drift before failure
- Correlates conditions to group symptoms under initiating causes
- Calculates scope and impact across upstream and downstream dependencies
- Recommends next steps for remediation, escalation, or automation
How KDE Works Under the Hood
Inputs
Metrics, logs, traces, and flow data from infrastructure, platforms, and services- Cloud, SaaS, and orchestration telemetry
- Security, performance, and availability signals
- Change signals from scale, load shifts, and configuration drift
Processing
- Normalizes and classifies signals so they map to the right assets
- Builds adaptive baselines that reflect real operating patterns
- Detects abnormal behavior and drift, then correlates related conditions
- Applies domain logic and customer-defined models
- Uses the Relationship Graph to compute dependency-aware scope and priority
- Reduces noise by grouping symptoms under initiating causes
Outputs
- Degradation insights with “why now” context
- Initiating-cause conclusions and affected downstream services
- Forward-looking risk (trend drift, capacity exhaustion)
- Total scope of impact across services and business structures
- Decision-ready inputs for remediation, escalation, or automation
Why This Matters in Real Operations
Incident Response
KDE identifies initiating cause behind alert storms and shows which downstream services are affected, so teams can act without a proof exercise.
Proactive Operations
Degradation trends surface early so teams can intervene before outages, SLA misses, or user impact.
Change and Risk Management
Dependency-aware impact makes it safer to approve changes and reduces unintended consequences in complex environments.
What to Test During Technical Evaluation
Use this checklist to confirm KDE delivers reliable conclusions, not just more signals.
Insight Accuracy
- Confirm anomalies reflect real degradation, not expected behavior
- Validate baselines adapt to daily and seasonal patterns
- Inspect how KDE explains why a condition matters
Root Cause and Impact
- Confirm initiating causes are identified, not just symptoms
- Trace how downstream impact is calculated using dependency context
- Verify alerts are grouped by cause, not by volume
Predictive Capability
- Validate forward-looking insights (trend drift, capacity exhaustion)
- Confirm predictions update as conditions change
- Assess usefulness for planning, not just response
Relationship Graph Context
KDE relies on the Relationship Graph maintained by the Relationship Discovery Engine (RDE). The graph provides the live dependency structure KDE uses to evaluate scope, impact, and priority.
Telemetry becomes actionable when evaluated against real relationships. KDE does not analyze signals in isolation. Every conclusion is topology-aware.
Key Terms (Quick Definitions)
Dynamic baseline
Learned “normal” behavior that updates as patterns change
Anomaly
A meaningful deviation from expected behavior
Drift
A gradual change that can signal rising risk
Initiating cause
The original condition that triggers downstream symptoms
Total scope of impact
All upstream and downstream dependencies affected
Predictive insight
A forecast based on trend patterns over time
Noise suppression
Grouping related symptoms under one initiating cause
Frequently Asked Questions
How is KDE different from traditional monitoring?
Monitoring reports conditions. KDE explains cause and impact using dependency context.
Does KDE require static thresholds?
No. KDE uses adaptive baselines that learn normal patterns over time.
How does KDE reduce alert fatigue?
By correlating signals and identifying initiating causes, KDE replaces many alerts with a smaller set of actionable conclusions.
How does KDE work with RDE?
RDE provides dependency structure. KDE applies reasoning on top of it to drive scope, impact, and next steps.
