Video by NetApp Instaclustr via YouTube
It’s 2:14 AM. Your anomaly detector fires: p99 latency is spiking on payment-service. The detector tells you THAT something is wrong. It doesn’t tell you WHY.
Manually, getting to a first hypothesis took 20 minutes of tab-hopping through dashboards, logs, and deploy history. An AI investigation agent built on OpenSearch did it in 3 seconds, and reached the same answer: a breaking change in the latest deploy cut the pooled DB connections from 20 to 10.
In this video I walk through how to wire it up:
• The investigation gap: what anomaly detection leaves you to figure out
• The architecture: anomaly_detector → alerting_monitor → flow_agent
• The five tools the agent runs, in order
• Live agent output and the root-cause report
• 4 rules for designing agent tools that don’t hallucinate:
• Why too many agent reports cause alert fatigue, and how to avoid it
• Demo: the Incident Investigator dashboard, with Claude on Amazon Bedrock
Helpful links:
Code + configs: https://ntap.fyi/oscna2026
30 day free trial: https://ntap.fyi/free
Free hands-on OpenSearch courses: https://ntap.fyi/courses