From an alarm flood to one incident with a named origin
A single device fault produces hundreds of correlated alarms buried in background noise. Raincurve decides which alarms belong together — and which one started it.
Alarms either happen on their own, or something caused them.
Raincurve models alarms as a Hawkes process — the same statistics used for earthquake aftershocks. Every alarm is either background (a genuine origin or routine noise) or triggered by an earlier alarm, with influence that decays over time.
Excitation is constrained to devices that are physically connected, and two decay timescales capture both hop-by-hop propagation (seconds) and repeated polling (minutes). The model is fit with expectation-maximization and needs no labels.
The result is a most-likely parent chain for every alarm. Follow it back and you reach the origin.
The model learns the cascade an engineer would draw.
Without any labels, the learned excitation matrix recovers relationships like routing adjacency loss driving host-unreachable alarms one hop away. Operators can read it, question it and override it.
Rule engines fail under noise because they pull in every nearby alarm. The Hawkes model asks whether an alarm is better explained by a cascade or by its normal background rate — so routine events stay out of the incident.
1.891 hop
1.331 hop
0.44same device
0.40same device
0.39same device
What operators get
One ticket per incident
Related symptoms across layers arrive as one incident, not a queue of duplicates across teams.
A ranked origin
The most likely root-cause device and signal, with the parent chain that led there.
Robust to messy telemetry
Tested with 15–40% alarm loss, clock skew up to 60 seconds and overlapping incidents.
Noise that stays noise
High-base-rate events like periodic CPU spikes are explained away instead of grouped in.
Cross-layer narrative
Network, compute, cloud and application symptoms combined into a single timeline.
Real-time
Grouping is fast enough to run continuously on commodity hardware.
Research
Method, results and limits for the techniques on this page.
Turning alarm floods into incidents with Hawkes processes
75% of root-cause devices found vs 42% for tuned rules, with no labels.
Read paper →Research BlogWhy alarm correlation needs a causal model
What time windows miss when background noise rises.
Read article →ResearchCurve-1: a reasoning architecture
The four-stage pipeline behind cross-layer root-cause ranking.
Read paper →