Anomaly monitoring
Monitors watch every Interface and Worker for anomalies, and each alert opens an Issue or an Incident within five minutes.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC7.2 | The entity monitors system components for anomalies that indicate malicious acts, natural disasters or errors. |
| SOC2 CC7.3 | The entity evaluates security events to determine whether they are incidents that require a response. |
| ISO27001 A.8.16 | Networks, systems and applications are monitored for anomalous behavior, and potential incidents are acted on. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every monitor alert in the report period. |
| Assert | Each alert links to an Issue or Incident opened within five minutes of firing. |
Owner
Reliability Engineer, Engineering Team.
Example
Checkout errors on a print-on-demand shop jump from 0.1% to 4% in two minutes. The monitor fires and opens an Incident 90 seconds later, with the failing requests attached.