How Pulse Works

Pulse ingests events from every connected source — CloudTrail, GuardDuty, Datadog, and more — suppresses the noise, and surfaces only clusters worth your attention. Each cluster is ranked by severity and escalates to an incident in one click.

Pulse reduces 13K raw events to 40 actionable clusters — live, in one view

Your monitoring stack already catches anomalies. The problem is volume: engineers spend more time triaging alert floods than fixing real problems. Pulse sits in front of every source and decides what deserves your attention, so you open a ranked list of clusters instead of six dashboards.

​

How it works

Every event that reaches Pulse goes through the same eight-stage pipeline before it becomes something you see.

1. Ingest — An event arrives from any connected source: an AWS poller picks up a GuardDuty finding, a Slack message fires from your alerts channel, or a Datadog webhook posts an alert.
2. Normalize — A source-specific collector translates the raw event into a common signal shape, extracting title, severity, category, resource ID, and timestamp regardless of origin.
3. Deduplicate — A SHA-256 fingerprint is computed from the signal’s source, type, resource, and timestamp minute. If an identical event arrived within the last hour, the existing signal’s dedup count increments instead of creating a new row.
4. Suppress — The signal passes through suppression layers in priority order; if any layer fires, the signal is stored as suppressed and hidden from your feed. See Clusters & Suppression for how each layer works.
5. Persist — The signal is written with its final suppressed status, severity, and extracted fields. Suppressed signals are retained for 90 days — toggle Show suppressed to review what was filtered.
6. Correlate — Within a 15-minute window, Pulse groups signals sharing the same resource, service, or title pattern into a cluster. Nine EC2 alerts become one cluster with nine members.
7. Classify — An AI model assigns category, canonical severity, a one-line summary, and an actionability verdict — whether this warrants creating an incident.
8. Route — Critical and High severity signals, plus any signal marked actionable, escalate automatically: a linked incident is created and root cause analysis begins. Everything else is delivered as a notification only.

​

What you can do

​

Key concepts

The pipeline panel in the left sidebar renders all four stages as a live funnel:

​

Next steps