Agent Rules — Simple Observe

Agent rules automatically invoke an AI flow when specific anomaly rules or tag rules are matched, or on manual trigger. The agent performs root-cause analysis and can optionally create a GitHub issue with sanitised details assigned to Copilot. All flows are safety-gated via the configured guard model.

Create Agent Rule

Rule Name *

Description

Trigger Type

Trigger Rule Reference

Which rule must fire to trigger this agent flow.

Trigger State

Rate Limit (minutes)

Minimum minutes between automatic runs.

Actions

LLM Analysis & Suggestion

DLP Check (before GitHub issue)

Create GitHub Issue (mention Copilot for suggestions)

Agent Rules (0)

No agent rules yet. Create one above to get started.

Recent Agent Runs (last 20)

No agent runs yet.

From Seasonal Anomaly to GitHub Work Item

Work Items connect the anomaly pipeline to GitHub execution. A seasonal metric rule detects an unusual point, an agent rule decides whether to open or reuse an issue, Copilot can be assigned automatically, and this page mirrors the resulting issue and pull request lifecycle.

Derived Signal Seasonal Rule Agent Rule GitHub Issue Copilot Task Status Sync

Metrics Engine

Builds minute-level signals and calculates the warning or critical anomaly state.

Agent Rule

Matches the event, applies cooldown and dedupe, then prepares analysis and suggested fix text.

GitHub

Stores the issue, assignee, and linked pull request that become the execution record.

Work Items

Shows the issue number, dedupe outcome, Copilot assignment badge, and PR link in one row.

Step 1: Seasonal Rule Detects the Anomaly

Example signal: latency p95. The active UTC bucket baseline changes through the day, so expected peak traffic does not look anomalous.

seasonal baseline envelope actual signal state-changing point

Once the point crosses the active seasonal bucket threshold, SOBS records the anomaly state together with service, signal, and telemetry context. That event becomes the input for agent automation.

Step 2: Agent Rule Decides Whether to Create or Reuse an Issue

The agent flow is not just "open an issue". It filters noise first, then chooses the safest GitHub action.

Cooldown reduces repeated issue creation for the same pattern.
Dedupe can attach a new occurrence to an existing canonical issue instead of opening another one.
The persisted work item captures dedupe decision, issue URL, and the generated RCA/fix summary.

Step 3: Issue + Copilot Adds an Execution Path

If the rule action is Issue + Copilot, SOBS requests GitHub Copilot assignment after the issue is created or reused.

requested active PR linked completed

The Work Items row surfaces the assignment badge. Typical states are requested, active, blocked, failed, and completed, so you can see whether Copilot is working, could not start, or already finished.

Step 4: Track Progress in GitHub and Back in SOBS

GitHub is the execution surface. The Work Items page is the observability surface that summarizes what GitHub reports back.

What to watch in GitHub

Issue title and body generated from telemetry context, analysis, and suggested fix.
Assignee list to confirm whether GitHub Copilot is attached to the issue.
Linked pull request and review activity once implementation starts.
Issue state moving from open to closed after the fix lands.

What SOBS mirrors on this page

Issue column: GitHub issue number, action type, Copilot badge, and PR link.
Dedupe badge: whether the event opened a new issue or reused an existing one.
Status filters: narrow to open or closed issue state during triage.
Details modal: review the saved root cause analysis and suggested fix that produced the issue.

Component ownership summary: metrics rules decide if the signal is anomalous, agent rules decide what automation to run, GitHub owns the issue and PR workflow, and Work Items provides the single-page audit trail for that lifecycle.

Automated Agent Flows