Aeion Neural Bus for Cross-Module Incident Correlation
A single customer-visible incident often has a single root cause that fans out across multiple modules. Per-module monitoring sees the fan-out; nobody sees the cause. Neural Bus's Event Correlator + Pattern Detector + cross-module event streaming surfaces the underlying cause and the affected modules together — turning "we're getting Slack alerts from 4 different teams" into "Stripe webhook latency is the root cause; 4 modules are affected; here's the rollback plan."
The Pattern
A typical mid-Saturday-morning incident:
How Neural Bus Correlates Cross-Module
`
Correlation Walkthroughs
`
What Neural Bus Tells the Human
Neural Bus doesn't just say "incident detected." It gives the on-call engineer the briefing:
What Neural Bus Does NOT Replace
Being honest:
FAQ
SIEMs (Splunk, Sumo) correlate via log search — query the log store, find patterns. Neural Bus correlates in real-time at event-emission time. SIEM is for forensics; Neural Bus is for action.
Partially. Outbound events flow naturally. For inbound external events (e.g., Stripe webhook delivery logs), integrate via webhook bridge or via Sentinel — Neural Bus can ingest those into its correlation rules.
Rule-based: sub-5ms rule matching (per the platform's in-memory correlation budget), typically ~50-100ms including event-arrival overhead. SLM-routed: under 500ms (Claude Haiku with cache).
Lower than per-module rules because cross-module signals require multiple coincidences. False positive risk is highest when modules share an underlying dependency (DB, third-party API); tune thresholds per-tenant.
Per-tenant. Most patterns ship as starter templates; tenants tune confidence thresholds + add custom patterns over time via the Neural Bus dashboard and rule configuration.
Cross-module remediations are typically high-blast-radius — most tenants disable auto-execute and require human approval. Some routine patterns (rate-limit X downstream service when Y upstream is degraded) can be auto-executed.
Audit log entries are events. Neural Bus can include audit events in its correlation. Useful for "credential rotation cascade" and similar.
Modest. Event stream is Redis-based (not Postgres). Pattern indices are kept in Redis. Audit log writes to Postgres asynchronously, so correlation doesn't add load to your application database even at high event volumes.
Yes. All correlations persist in the audit log, and the Neural Bus dashboard's Signal Matrix surfaces recent + recurring patterns for post-mortem review.
Rule-based correlator doesn't (deterministic). SLM analysis benefits from accumulated training context — tenants with longer histories see better novel-pattern detection. Per-tenant feedback (mark false positive → tune the rule) helps tune over time.