Most alerts are manufactured noise. A Dynatrace Davis AI engine is built to do the opposite, and pick the one real problem out of a flood of signals.
Davis is the reasoning layer that ships with the Dynatrace observability platform. It watches events across the stack, from the front end down to the database, and works out what actually caused an incident. The part that matters is not the correlation. It is the ordering. The system decides which change came first and which one is merely a symptom.
Root cause is a sequence, not a snapshot
The hard part of any incident is causality. Two things break at once and the question is which one triggered the other. Davis builds a temporal model of the environment and replays the sequence in real time. When a service degrades, it looks back at what moved in the minutes before, and it points you at the change upstream.
That is a big upgrade over threshold alerting. A classic alert fires because latency crossed a number. It does not tell you the write on the primary database was the cause and the slow queries were the effect. Davis attempts that second step automatically.
Davis also leans on topology. It knows how services are connected, so when a change ripples outward it can trace the path from one component to the next. That view is what separates a simple correlation from a cause candidate ordered by time.
The system learns your baseline. It knows what normal traffic looks like for a given service and flags shifts relative to that shape. This is why it can separate a real degradation from a busy-hour spike.
Why it matters to a tired on-call engineer
Attention is the scarcest resource in any operations team. A page that sends an engineer to a dashboard with a single candidate cause is worth far more than a page that lists twenty alerts. Davis is designed to shrink the number of candidates before a human opens anything.
The effect on mean time to detect is the headline, and the effect on mean time to resolve is the quiet benefit. When everyone agrees on the cause, the fix conversation moves fast. Teams spend their energy on remediation instead of arguing about which alert to trust.
The parts that still need a person
Davis is good at structured telemetry and less certain about oddball cases. It reasons from events that are observable. If the cause lives in a place nobody instruments, like a third party API you cannot see, the analysis stops where the data stops.
Correlation still is not proof. Davis can identify a strong suspect and be wrong about the mechanism behind it. A platform engineer has to read the context and judge whether the proposed cause explains the symptom. The tool narrows the space. It does not close the case.
There is a risk of over-trusting the machine. Teams that default to the agent’s answer stop building their own instincts. The best practice is to treat a Davis conclusion as a strong lead and pair it with the raw data, not to accept it without a glance.
The commercial angle matters too. Davis is tied to the Dynatrace platform, so you get its value only if you are already deep in that stack. Mature observability toolchains that feed their telemetry elsewhere will not see these answers without a migration.
Look past the vendor gloss and the trend is real. The next generation of observability is not about collecting more data. It is about deciding which data tells you what is wrong, and handing you the answer instead of another dashboard. Davis is one of the most mature attempts at that, and the rest of the market is racing to match it. Learn more about the Davis AI engine.