Add FAQ

Author: jpipkin1

docs/observability/service-intelligence.md

@@ -14,37 +14,101 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 <img src={useBaseUrl('img/observability/service-intelligence-icon.png')} alt="icon" width="50"/>
 
-Service Intelligence uses AI to analyze logs to generate a map of system services, revealing areas that require attention. It surfaces real-time signals for issues such as latency, errors, high traffic, and security anomalies, providing actionable paths for root-cause analysis.
+Service Intelligence uses AI to generate a map of system services, revealing areas that require attention. It surfaces real-time signals for issues such as latency, errors, high traffic, and security anomalies, providing actionable paths for root-cause analysis.
 
-The functionality of Service Intelligence is similar to that of the [Services list and map](/docs/apm/traces/services-list-map/), but uses AI to generate the list and map, providing deeper insights and more targeted surfacing of areas of concern.
+The functionality of Service Intelligence is similar to that of the [Services list and map](/docs/apm/traces/services-list-map/), but uses AI to generate the list and map, providing deeper insights and more targeted surfacing for areas of concern.
 
-## View a service list and map
+## What is Service Intelligence?
 
-The service list and map visually maps out your application environment, giving you a greater understanding of your application architecture, hierarchy, and dependencies between monitored microservices. Health and load of each microservice is reflected in size and color of nodes in the map to help you spot potential problems and bottlenecks in your application infrastructure.
+Service Intelligence leverages an AI generative context engine to analyze your organization's raw log data to provide dynamic observability of the services in your enterprise. It determines real-time environment status and dynamically builds visualizations and instructions to guide troubleshooters. Service Intelligence provides developers, security, and IT operations teams with a single source of truth and remediation recommendations in natural language. Insights are generated by passing a sample of data for the past 15 minutes.
+
+Engineers that are responsible for maintaining the uptime of a service would benefit most from Service Intelligence. Depending upon the company and how you manage your operations, these could be development operations (DevOps) engineers, service reliability engineers (SREs), or information technology operations (ITOps) engineers.
+
+## View Service Intelligence
+
+To open Service Intelligence, in the main Sumo Logic menu of the [**New UI**](/docs/get-started/sumo-logic-ui), select **Service Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Service Intelligence**. (Service Intelligence is not available in the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic).)
 
-1. In the main Sumo Logic menu of the [**New UI**](/docs/get-started/sumo-logic-ui), select **Service Intelligence**. (Service Intelligence is not available in the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic).) You can also click the **Go To...** menu at the top of the screen and select **Service Intelligence**. 
-1. A list of services is displayed to the left, and and a map of services is displayed in the center. These services are automatically identified by AI analysis of logs in your entire enterprise. <br/><img src={useBaseUrl('img/observability/service-intelligence-initial-map.png')} alt="Service Intelligence list and map" style={{border: '1px solid gray'}} width="800" />
+### View a service list and map
+
+The service list and map visually maps out your application environment, giving you a greater understanding of your application architecture, hierarchy, and dependencies between monitored microservices. Health and load of each microservice is reflected in size and color of nodes in the map to help you spot potential problems and bottlenecks in your application infrastructure.
+ 
+1. When you first open Service Intelligence, a list of services is displayed to the left, and and a map of services is displayed in the center. These services are automatically identified by AI analysis of logs in your entire enterprise. <br/><img src={useBaseUrl('img/observability/service-intelligence-initial-map.png')} alt="Service Intelligence list and map" style={{border: '1px solid gray'}} width="800" />
+1. The legend at the bottom of the screen shows that red nodes in the map represent anomalies, while blue nodes indicate normal, expected activity. Use the zoom buttons to resize the map.<br/><img src={useBaseUrl('img/observability/service-intelligence-size-buttons.png')} alt="Resize buttons" style={{border: '1px solid gray'}} width="200" />
 1. To refresh the list of services and the map:
+    1. Click the **Regenerate Map** button in the upper right to toggle the **Regenerate Map** panel.<br/><img src={useBaseUrl('img/observability/service-intelligence-regenerate-map.png')} alt="Regenerate map" style={{border: '1px solid gray'}} width="125" />
     1. Click **Regenerate** in the **Regenerate Map** panel to right. The service list and map will be regenerated with the last 15 minutes' worth of data.
-    1. Click the **Regenerate Map** button in the upper right to hide the **Regenerate Map** panel.<br/><img src={useBaseUrl('img/observability/service-intelligence-regenerate-map.png')} alt="Regenerate map" style={{border: '1px solid gray'}} width="125" />
-    1. Use the buttons at the bottom of the screen to resize the map.<br/><img src={useBaseUrl('img/observability/service-intelligence-size-buttons.png')} alt="Resize buttons" style={{border: '1px solid gray'}} width="200" />
+    :::warning
+    It is only necessary to regenerate the map if it has been longer than 15 minutes since the map was last generated. Do not regenerate the map multiple times in quick succession, because doing so will not result in new results.
+    :::
+    1. To provide feedback on the map, select from the available **Issues** or **Variations** on the **Regenerate Map** panel. We use this feedback to fine-tune map output. 
 
-## View the signals summary
+### View the signals summary
 
 Clicking the **Insights** button displays a **Signals Summary** panel that shows a summary of service signals and steps to take to remediate issues.
 
 1. Click the **Insights** (light bulb) button in the upper right. <br/><img src={useBaseUrl('img/observability/service-intelligence-insights-button.png')} alt="Insights button" style={{border: '1px solid gray'}} width="125" />
 1. The **Signals Summary** displays findings, for example:<br/><img src={useBaseUrl('img/observability/service-intelligence-signals-summary.png')} alt="Signals summary" style={{border: '1px solid gray'}} width="300" />
-1. Read the summary to find areas of concern and actions you can take. 
+1. The summary contains observations, root cause analysis, and next steps. Carefully review the summary to learn actions you can take. 
 
-## View service signals
+### View service signals
 
-When you click a service in the list in the upper left, or a node in the map, a **Service Signals** panel displays. The panel contains findings about the service with log examples and steps you can take to remediate problems with the service.
+When you select a service in the list or a node in the map, a **Service Signals** panel displays to the right. The panel contains findings about the service with log examples and steps you can take to remediate problems with the service.
 
 1. Click the **Insights** (light bulb) button in the upper right.
-1. Click a service in the list on the left, or click an individual node in the map. In the following example, we've clicked the Checkout Service.<br/><img src={useBaseUrl('img/observability/service-intelligence-checkout-service-example.png')} alt="Checkout Service example" style={{border: '1px solid gray'}} width="800" />
-1. Notice how the **Service Signals** panel displays signals that require attention. When you click **Show Log Example**, it displays an example of a log entry that illustrates the issue. You can use this information to query for logs with similar content.<br/><img src={useBaseUrl('img/observability/service-intelligence-log-example.png')} alt="Log example" style={{border: '1px solid gray'}} width="300" />
-1. Scroll to the bottom of the **Service Signals** pane to the **Next Steps** section. This section describes concrete steps you can take to remediate issues identified in that node.<br/><img src={useBaseUrl('img/observability/service-intelligence-next-steps.png')} alt="Service Intelligence next steps" style={{border: '1px solid gray'}} width="300" />
+1. Click a service in the list on the left, or click an individual node in the map. In the following example, we've selected the Checkout Service.<br/><img src={useBaseUrl('img/observability/service-intelligence-checkout-service-example.png')} alt="Checkout Service example" style={{border: '1px solid gray'}} width="800" />
+1. Notice how the **Service Signals** panel displays signals of interest. When you click **Show Log Example** for one of these signals, it displays an example of a log entry that illustrates the issue. You can use this information to query for logs with similar content.<br/><img src={useBaseUrl('img/observability/service-intelligence-log-example.png')} alt="Log example" style={{border: '1px solid gray'}} width="300" />
+1. Scroll to the bottom of the **Service Signals** pane to the **Next Steps** section. This section describes concrete steps you can take to remediate issues identified in the selected node.<br/><img src={useBaseUrl('img/observability/service-intelligence-next-steps.png')} alt="Service Intelligence next steps" style={{border: '1px solid gray'}} width="300" />
 1.  From the **Next Steps** section, you can also:
      * View transactions dependent on the selected node.
      * Open [Copilot](/docs/search/copilot/) to investigate further.
+
+## FAQ
+
+### How is data for Service Intelligence generated? 
+
+Data for Service Intelligence is generated by our AI system leveraging Claude on Bedrock, which is specially trained to provide actionable signal intelligence at the system level. The dataset is sampled periodically every 15 to 30 minutes using our proprietary algorithm, which ensures comprehensive log collection from all services. It effectively deduplicates logs and filters out noise to maintain data quality.  
+
+### What is the confidence level of the large language model (LLM) output? 
+
+There is a high degree of confidence in the AI outputs as verified through human judging of sample sets. Sumo Logic internally relies on the human judging process and follows that up with tuning the dataset or the prompt.
+
+Furthermore, you can provide feedback on the map in the **Regenerate Map** panel, such as noting it is missing services.
+
+### What is generated ? 
+
+Data is generated by passing a sample of data to the LLM for the past 15 minutes along with a prompt. This returns a "service summary" (also known as "insights") of logs along with log messages related to the signals generated, with a hypothesis of the problem and next steps for further exploration.
+
+Our AI delivers actionable intelligence in near-real-time via log analysis only. The resulting service map highlights the interconnection of various services and components. The summary and signals highlight what services are functioning normally, and any that might have errors, high traffic, or latency issues. Clicking on an individual service you can view the specific signals generated for the service. Next steps are suggested for how to resolve any issues that might be present. From there, you can view example log lines, and dig deeper into the logs if needed. 
+
+### How does regeneration work ?
+
+Regeneration takes the same sampled data that was used for the first attempt and sends it to the model again, along with special instructions based on the user’s feedback about whether anything looked incorrect (missing services, wrong connections, service names), and how different they want the result to be (subtly different, or very different). 
+
+The idea is that the model gets to try again with a hint about what to focus on. The new result may be the same or different, and it may or not be more correct than the original result. 
+
+### What are the signal types?
+
+The signal types are: 
+* **Latency**. Increase or decrease in latency of the requests to the system.
+* **Traffic**. An increase or decrease in traffic requests to the service.
+* **Error**. The count of error signals detected.
+* **Saturation**. A change in resource usage of the system.
+* **Security**. The count of logs that indicate security concerns. 
+
+These signals are extracted based on the logs observed for the last 15 minutes.
+
+### Is customer data used to train the model? 
+
+No customer data is used to train the model. We use a Foundation Model (FM) with custom prompts that don’t use customer data to train.
+
+### What sort of instrumentation is required? 
+
+No instrumentation is required. You can send your structured and unstructured data to Sumo Logic through normal data collection to drive Service Intelligence.
+
+### And are log format limitations?
+
+There is no limitation on log formats. 
+
+### Can you choose which logs to use in Service Intelligence?
+
+No, you can't choose which logs to use in Service Intelligence.