Skip to main content
The AI Assistant section of the dashboard groups every page that asks the AI service for an answer. It is marked beta in the sidebar. Most of these pages need a language model. A model is configured by whoever operates your deployment, not per user — so on some deployments every page works, and on others several pages explain that a prerequisite is missing. This page tells you which is which.
Before you start. You need to be signed in with any role, and your organization needs telemetry arriving — see Send data with OpenTelemetry. Whether a model provider is configured depends on your plan and deployment. If you operate aiAxonIQ yourself, see Configuring AI providers.
This page covers the Assistant section. Anomaly detection, forecasting and suggested alert rules and SLOs are described in AI features.

​
What each page needs

The Assistant landing page lists every page below with one line on what it does and what it needs. It makes no call of its own: it states requirements rather than guessing at your configuration, and a page whose prerequisite is missing says so when you use it. “An embedding model” is narrower than “a language model”: today the only embedding model the AI service uses is OpenAI’s, so Correlation and Knowledge base work only on deployments configured with OpenAI as the provider.
Anomaly detection and forecasting need no model at all. They are statistical and run on every deployment where the AI service is reachable — including anomaly alert rules. See AI features.

​
Investigate

Ask a question about production in plain language — why did checkout latency increase? — and an agent works through it one step at a time: it chooses a tool, reads what the tool returns, and decides what to look at next, until it can answer or runs out of budget.
1

Open Investigate

In the sidebar, open AI Assistant → Investigate. You can also run the Investigate a problem command from the command palette.
2

Ask a question

Type your question and press Investigate (or Enter; Shift+Enter adds a line). Suggested questions appear under the box until a run starts. A question is limited to 8,000 characters — the box tells you before you reach it. The agent chooses its own time window and is scoped to your organization; you cannot point it at another one.
3

Watch it work

The page shows the investigation as it happens. Nothing about the run depends on your browser tab: if you reload, or the connection drops, the page rejoins the same run.
Each run gets its own address (/assistant/investigate/<id>) as soon as it starts, so a reload returns you to it and you can send the link to a colleague in the same organization. A link to a run in another organization, or to one that does not exist, shows This investigation is not available — the two are deliberately indistinguishable.
Investigations also start on their own. When an alert opens an incident, aiAxonIQ starts one investigation for that incident with the same agent, tools and limits, authorised as a Viewer. It cannot ask anyone a question or wait for an approval. The dashboard does not list these investigations yet, so there is no page today from which to open one.

​
What an investigation shows

Hypotheses, impact, the timeline and coverage appear once the finished run has been read back; while a run is live they may be absent.

​
How to read the answer

The confidence level and the verdict are computed from the evidence, not reported by the model. After the agent proposes an answer, every claim in it is checked against the evidence the tools actually returned:
  • A claim that cites evidence no tool produced is dropped. The page says so: 2 proposed claims did not survive validation and are not shown above.
  • A causal claim resting on only one kind of evidence is not published. The answer can still describe what was observed, with no root cause — which is the honest shape of “here is what we saw, and we cannot say why”.
  • No supported conclusion is a result, not a failure: the signals were checked and none explains the symptom. Investigation incomplete means the run stopped before it could conclude — a different answer, and the one that means keep looking.
  • Confidence is shown as a word and a three-step bar, never a percentage, because only three levels exist.
Treat an answer as a lead to verify. The evidence cards are there so you can check the conclusion in two clicks — open the linked data and confirm the number yourself before acting on it.
If the run hits a limit, the answer says The run hit its budget before finishing. This is what it had concluded by then. The limits are described in How the investigation agent is governed.

​
Approvals and questions

Two panels can appear above the activity, and the run waits on each:
  • The agent needs an answer — it asked you a clarifying question. Reply and the run continues.
  • Approval required — a tool call that needs a person’s approval. Today no tool needs one (every registered tool is read-only), so you should not see this panel. How approvals work when one does is described in How the investigation agent is governed.

​
Ask your data

Type a question — which services had the most errors in the last hour? — and press Ask. The page shows the Generated query first, with the row count and execution time, and the results below it in a table you can search, sort and download. The query runs as a per-organization database identity, so it cannot read another organization’s data whatever the model writes.
Read the generated query before trusting the number. The failure mode is a plausible query that answers a slightly different question. If a query ran and matched nothing, the page says The SQL above ran successfully and matched nothing — that is an empty result, not an error.

​
Root cause

Paste a stack trace, error message or log lines into Error or log snippet, optionally name the Service, and submit. The answer has a severity, a Summary, a Proposed root cause and Recommended actions. Unlike Investigate, Root cause reads nothing but what you pasted — it does not query your telemetry. Every answer ends with Generated by <provider>. Treat it as a lead to verify, not as a finding. Each analysis is saved to Insight history.

​
Suggested fixes

Paste the failure into What is failing and choose Suggest fixes. Two things are asked at once:
  • Recommended actions, reasoned from your snippet by the language model.
  • From your runbooks — matching entries from your Knowledge base. This half needs an embedding model; without one the page says Semantic ranking is unavailable beside the actions rather than silently showing no runbooks.
If one half fails, the other is still shown. Runbook suggestions are saved to Insight history.

​
Correlation

Paste a failure and choose Find related incidents to search the incidents indexed in your Knowledge base for ones whose text resembles it.
This is similarity, not causation — the page says so above the form. A high score means someone wrote something similar before, not that the two incidents share a cause. A similarity score is shown only when an embedding model ranked the result.

​
Knowledge base

Search your indexed runbooks and past resolutions, and Add an entry with a Title and Content (what happened, how it was diagnosed, and what fixed it).
Adding an entry requires the Editor role or higher, because an entry is retrievable by everyone in your organization. Do not add anything you would not show every member. See Roles and permissions.
Without an embedding model the Knowledge base neither ranks nor stores entries: the page shows Semantic ranking is unavailable and explains that results could otherwise only be ordered by a hash of their text, which is not similarity.

​
Insight history

A table of earlier Root cause analysis and Runbook suggestion results for your organization, with when each ran and for which service. View shows the saved result exactly as the AI service produced it. It needs no model; it is empty until Root cause or Suggested fixes has run. Investigations are not listed here — each has its own address under Investigate.

​
When no model is configured

The pages do not work around a missing prerequisite, and none of them shows invented or sample output. What you see instead: If the AI service itself cannot be reached, the task pages say The AI service is not reachable from this deployment. Everything else in the product is unaffected. — and it is: every other section works without it.
Investigate’s failure message says “could not be reached” even when the service is up and simply has no model configured. Both cases end the run with llm_unavailable. If Root cause on the same deployment reports that no model key is configured, that is the cause.

​
Troubleshooting

Starting investigations is limited per organization: 20 per minute, and a cap on how many run at the same time. The error is shown with a Try again button. The concurrent cap clears as a running investigation finishes.
The validation step runs in the AI service. If it cannot be reached, the run fails rather than publishing an answer nobody checked.
The page says The connection dropped. Rejoining the run — nothing above is lost, and the agent kept going. Wait, or reload: the run continues on the server either way.
Nothing validated this answer, so it carries no verdict and no confidence means the answer was not checked against the evidence. Treat it as the model’s account of what it found, not as a checked conclusion.

​
Limitations

  • A model can be wrong. Validation stops the agent from citing evidence it never retrieved; it does not make its reasoning correct. The evidence is there so you can check.
  • An investigation sees only what your organization sends. If a service sends no traces, the agent cannot reason from traces, and the coverage panel shows what it looked at.
  • There is no Stop button on the Investigate page today. A run ends when it answers, fails, or reaches one of its limits; its time budget is five minutes.
  • Answers arrive in chunks, not word by word.
  • Root cause, Suggested fixes and Correlation read only what you paste. Investigate is the page that queries your telemetry.

​
Next

How the agent is governed

Read-only tools, tenant scoping, limits and the audit trail.

Configuring AI providers

For operators: which providers work and how to check.

AI features

Anomaly detection, forecasting and suggestions.