Skip to main content
Investigations don’t just query your telemetry well on day one — they get better at it over time. Memory is how: a learned library of the queries that have actually worked for your data sources, built from your own investigations and fed back into every new query.

​
What memory is

When an investigation writes a query against one of your data sources and it successfully answers a question, that pairing is worth remembering — “to find out X, this kind of query works against this data source”. Memory is the store of those proven patterns, built up specifically for your systems. It’s related to, but distinct from, the guidance the system learns for each data source. Guidance is the broad description of a data source — its labels, fields, and conventions. Memory is the narrower set of queries that have actually worked. Guidance tells a query planner what exists; memory shows it what has worked before.

​
How it’s built

Memory grows from real investigations, on its own:
  • When a query answers a question — and is actually used in the investigation’s reasoning, rather than discarded as noise — it becomes a candidate to remember.
  • Queries that came back empty or unhelpful aren’t remembered, so memory reflects what genuinely works against your systems, not just what happened to run.
  • We curate it as it grows, consolidating overlapping patterns and retiring ones that no longer hold, so it stays sharp rather than sprawling.
There’s nothing to set up and nothing for you to maintain. Memory accrues as investigations run.

​
How it makes investigations better

When an investigation plans a new query, it draws on the remembered patterns most similar to the question and uses them as worked examples. Starting from a query shape that’s already succeeded — rather than from scratch — it reaches a correct query faster and with fewer wrong turns. Those same patterns also feed back into guidance, sharpening the broader picture the planner works from. The effect compounds: the more investigations run against your stack, the better the agent gets at querying it.

​
Scoped to your systems

Memory is specific to your organization, to each data source, and to each kind of query — the patterns that work for your logs are learned from your logs, and your metric names and labels are your own. Nothing in memory is shared across organizations.

How telemetry works

Routing, query planning, and the guidance memory feeds into.

Telemetry overview

What you can connect, and how it fits together.