PROBE is a shared "HIVE" that learns incident → fix patterns across a vendor's entire deployment fleet — without ever moving a customer's raw logs. Sanitized fingerprints go in; ranked, validated remediations come back, straight into Jira.
A vendor ships one product — an HMS, an ERP, a GitLab-style platform — into hundreds of on-prem or regulated customer environments. Each deployment breaks alone. Logs are siloed and often can't leave the customer's boundary for privacy or security reasons. So the same incident gets re-diagnosed from scratch at Site A, then B, then C — and support cost and MTTR grow linearly with fleet size, while hard-won fixes never travel between sites.
Healthcare (Bahmni, Aarogya), financial and government vendors run the same software across hundreds of regulated, walled-off environments.
Raw logs carry PII — Aadhaar numbers, health IDs, patient records — and privacy/compliance rules mean they usually cannot leave the deployment.
Without raw logs to compare, nothing carries the fix from one site's incident to the next site's identical one. L2/L3 support relearns it every time.
Because every deployment runs the same software, the fields that make cross-deployment matching possible — service names, error classes, versions, fault taxonomy — are exactly the fields that carry no PII. That means the sanitization boundary and the matching boundary are the same line: stripping the private stuff costs almost nothing in match quality.
Logs, traces and errors stay inside the customer's deployment boundary — they never cross out.
Strips variable tokens (IDs, timestamps, hostnames) down to a symptom skeleton — the shape of the error, not its specifics.
Catches residual PII in the skeleton — Aadhaar numbers, health IDs, anything the categorizer missed.
Only this derived, client-agnostic fingerprint enters the HIVE — a shared Elasticsearch index — nothing else does.
No custom workflow engine. An anomaly becomes a ticket; the ticket carries the fingerprint; the agent does the searching and posts its reasoning as a comment; a human validates; the HIVE gets smarter for the next incident.
Anomaly detected on a deployment → a Jira ticket is created, carrying the sanitized fingerprint.
The agent searches the HIVE for prior incidents with the same symptom skeleton across the whole fleet.
Posts ranked remediations + runbooks + a confidence score + why it matched as a Jira comment.
The engineer pings back with new info, corrects the agent, or confirms — the ticket moves to COMPLETE.
The agent creates or updates a runbook, linked to the anomaly, incident, remediation, ticket and author. The hive gets smarter.
Jira tickets and GitHub PRs/commits sync in via native Elastic connectors. Each product version carries a date window, so when a deployment on that version errors, the changes shipped in that window become the prime suspects — linking an incident straight back to the PR that likely introduced it.
Instead of searching the whole commit history, the agent narrows to the commits and PRs that shipped inside the affected version's window.
GitHub and Jira sync into Elasticsearch through Elastic's own connectors — one more thing PROBE doesn't have to rebuild.
match_incident, get_resolution, blast_radius,
fleet_signal, check_version_risk, submit_outcome,
upsert_runbook — the same seven tools serve two different SKUs.
diagnose() call| Tool | What it does |
|---|---|
match_incident | Find prior HIVE incidents with a matching symptom skeleton |
get_resolution | Fetch the validated fix/runbook for a matched incident |
blast_radius | Find the PRs/commits in a version's date window that likely caused it |
fleet_signal | Check whether other deployments are seeing the same symptom right now |
check_version_risk | Score a version by its known incident history before rollout |
submit_outcome | Record whether a suggested fix actually worked — the feedback loop |
upsert_runbook | Create or update the runbook a validated fix gets linked to |
The custom build is small and deliberate on purpose: an orchestrator service, two UI screens, and the discipline of never rebuilding what Elastic already does well.
ML anomaly detection, categorization, retrieval and the agent runtime.
Edge transport, privacy redaction, and the reasoning model.
And falling as the hive learns — later matches need less reasoning, not more.
The agent proposes with a confidence score and its reasoning. A human validates before anything is marked COMPLETE.
The fields PII-free enough to leave the deployment are exactly the fields that make cross-fleet matching work.
This repo currently implements two concrete stages of the PROBE pipeline end to end — the Detector (finds the anomaly) and the Remediator (files the Jira ticket once a cause is known) — plus the supporting Elastic ML and pipeline work behind the HIVE vision above.