Overview

Detection is the second step of the loop. Once your stack is connected (Context), Polylane watches it and surfaces what needs attention. You don't write alert rules or tune thresholds. Agents read the telemetry and decide.

How detection works

Polylane assembles a check list for every connected cloud account and observability integration:

• Built-in checks for each provider, covering metrics, logs, and traces.
• Checks generated from your own saved queries and dashboards. Save a query or build a dashboard in your provider and Polylane picks it up on the next sync.
• Key queries you curate per account.

Each check resolves a signal, then a statistical pass and an agent decide together whether it points at a real problem. Each check knows which direction is worse for its metric, so an improvement never raises an issue. Deterministic thresholds exist only where a check explicitly declares one, such as crash-looping pods on a Kubernetes cluster. Every evaluation is recorded as a check run against the resource, with a status of healthy, breached, or stable, so you can audit what ran and what it concluded.

Detection surfaces

• Issues: the single detection lifecycle. Signals from Polylane's own checks and alerts from your connected providers both become issues.
• Change intelligence: every sync of a connected cloud produces a change record describing what was added, modified, or removed.
• Advisories: configuration and setup risks on your resources, such as missing observability coverage.
• Scans: a one-off, on-demand review of an account. Scans resolve the same check list continuous monitoring uses, so a scan sees exactly the signals Polylane watches.

From detection to investigation

Detection output feeds Investigation:

• An issue triage confirms as an incident gets an investigation. You can also start one on any issue by hand.
• Investigations run in threads, where agents query your providers and cite evidence.

Detection events also fire automation triggers. A change record fires polylane.change_record.created, an issue verdict fires polylane.issue.triaged, and a provider alert fires the alert trigger. See Automations.

Next steps

• Issues
• Change intelligence
• Advisories
• Scans