How Merlin turns telemetry into an investigation workflow

1. Operational telemetry

The investigation begins with machine-generated evidence: logs and operational events produced by systems and services. Preserving timestamp, source and relevant context is essential because those fields become part of the incident timeline.

2. Signal detection

High-volume telemetry contains a large amount of routine activity. Merlin is designed to identify changes and patterns that deserve attention, reducing the amount of data an engineer needs to inspect manually.

3. Correlation

Potentially related signals are compared across systems and time. The purpose is to build context around an incident rather than treating each stream as an independent set of search results.

4. Natural-language investigation

Once context has been established, the operator can ask questions about the incident, refine the scope and request explanations of the evidence. Follow-up questions retain the investigative context rather than starting again from an empty search box.

5. Evidence-led output

Generated explanations and suggested next actions are most useful when an engineer can validate them. Merlin is therefore designed around the idea that analysis should point back to the telemetry and relationships that support it.