AI Feeds Advisor¶
Overview¶
The AI Feeds Advisor (the Feed Lifecycle Advisor) is the most commonly used advisor in production. It handles DSM (Data Sources) and DHM (Data Hosts) entities — the bread-and-butter of TrackMe monitoring — and answers the recurring question “is this entity’s lifecycle configuration appropriate for its actual behaviour?”
A “lifecycle” in TrackMe terms is an entity’s runtime configuration story: how long after the last event is “still healthy”, what counts as an excessive delay or lag, whether to auto-tune thresholds, whether to apply different thresholds at different times of day, and how to weight delay/latency breaches against other anomaly signals. The advisor reads the entity’s recent history, compares it against peer entities on the same datasource, and proposes lifecycle changes grounded in real telemetry.
See The AI Advisors for the shared inspect/act model, the consent-card bridge, and the structured output contract that all advisors share.
When to use it¶
An entity is RED with a delay or latency threshold breach and you suspect the threshold is too tight (the most common trigger).
A new entity was created via the wizard with default thresholds and you want them tuned after a week of observation.
An entity’s delay bursts in clear weekday/weekend or business-hours patterns and a variable-delay schedule may fit better than a static threshold.
Adaptive delay was previously locked and you want to know if it is safe to unlock now that the pattern has stabilised (or vice versa).
You want to adjust the entity’s impact-score weights, or decide whether an entity should be decommissioned.
What it reads and writes¶
In inspect mode the advisor reads the full lifecycle context (configuration, thresholds, state, scoring, adaptive flags), the 7-day delay/latency history, the state-flip history, peer-entity comparison, the current variable-delay schedule, and the adaptive-delay change history.
In act mode it can additionally:
update delay / lag thresholds (
data_max_delay_allowed,data_max_lag_allowed),set the monitoring state (decommission-gated),
lock or unlock adaptive delay,
create or update a variable-delay schedule (per-slot day-of-week / hour-of-day thresholds),
adjust priority, tags and impact-score weights,
and attach labels and a formatted investigation note to the entity.
Walkthrough¶
Every DSM and DHM entity overview exposes an AI Feeds Advisor tab. It summarises what the advisor
does for this entity and offers a Launch Feed Lifecycle Advisor button. In this example the entity
siem-cloud-apac:google:gcp:pubsub:message is RED because of both a lag-threshold and a
delay-threshold breach.
The advisor runs in inspect mode first, reading the entity’s lifecycle context and history. It returns a structured verdict — here Needs Tuning — with an executive summary and a list of recommendations, each carrying the current value, the recommended value, and a rationale grounded in the observed ingestion behaviour and peer comparison.
The recommendations are specific and reviewable — for example raising data_max_delay_allowed from
3600s to 9000s to align with observed ingestion buffering and peer thresholds, designing a
variable-delay schedule for the business-hours pattern, and re-weighting the impact score.
When you choose to apply the changes, the advisor switches to act mode and executes each write through TrackMe’s REST API, re-reading to confirm the new state.
The Actions Taken panel lists every write the advisor performed — threshold updates, the adaptive delay lock, the priority/tags change, and the entity label and investigation note — each with its audit reason. A reasoning trace documents the analysis, and a link jumps to the advisor’s audit events for this entity.
Note
Coexistence with legacy Adaptive Delay — When the AI Feeds Advisor covers DSM/DHM for a tenant, it takes precedence over the legacy mechanical Adaptive Delay and Variable Delay auto-review mechanisms, which are automatically disabled for those components so they cannot revert the advisor’s per-entity decisions. Re-enabling the legacy mechanisms is a manual action from the Tenant Configuration modal.
Running it from the chat¶
In addition to the standalone modal, the AI Feeds Advisor can be proposed by the AI Assistant as a one-click consent card when you describe a feed problem in chat (e.g. “this entity is RED, the delay threshold looks too tight”). See The AI Advisors for the full bridge walkthrough.
Automated runs¶
The AI Feeds Advisor participates in the nightly automated batch, tuning eligible DSM/DHM entities within per-tenant policy (priority filter, freshness window, decommission guard). See AI Agents automation.