AI and Intelligent Automation
What this domain tests
Questions here cover Applied Intelligence alerting (static, baseline and outlier conditions), incident correlation, the generative AI assistant, and AI Monitoring for applications that call large language models.
Core rules
- Static threshold conditions suit known limits. Baseline (anomaly) conditions learn normal seasonality from historical data and alert on deviation. Outlier conditions compare one entity against its peers.
- Baseline conditions need a training history before they emit signals, so a newly created account or host stays quiet at first.
- Every condition has an aggregation window, slide-by and gap behaviour. Loss of signal - data stops arriving - is a different condition from a value above threshold, and gap-filling defaults can make a condition silently stop evaluating.
- Incident Intelligence groups correlated alerts into one incident, suggests responders and surfaces similar past incidents. It explains groupings; it does not prove root cause.
- The AI assistant converts natural language into NRQL and summarises incidents. Validate the field names it returns against the real event schema before relying on the query.
- AI Monitoring instruments LLM calls (for example OpenAI, Amazon Bedrock, LangChain) and records events such as LlmChatCompletionSummary with model, token counts, latency, cost and optional response-quality evaluations.
Worked example
A checkout service slows every weekday around 10:00. A static condition at 800ms fires daily and gets muted by the team. A baseline condition trained on several weeks of the same weekly pattern treats that rise as normal and only alerts when the deviation exceeds the learned band. Cost works the same way: 5,000 LLM requests per day at 2,000 prompt tokens ($3 per million) and 500 completion tokens ($15 per million) gives (2,000×3 + 500×15) ÷ 1,000,000 = $0.0135 per request, or $67.50 per day. Token usage belongs on the dashboard next to latency.
Traps
- Presenting a correlated incident group as a confirmed root cause.
- Expecting baseline alerts immediately on a new account.
- Setting a window so long that short spikes average away.
- Pasting generated NRQL without checking attribute names.