Skip to main content

Proactive Actions

Proactive actions are part of Autoheal's continuous learning. After an investigation closes, Autoheal looks across past investigations and surfaces proactive actions: concrete, grounded improvements you can make to detect issues sooner and stop them from recurring.

In the product these live under Detect & Prevent. Each action is tied back to the investigations that motivated it, so it comes with evidence rather than being a generic best practice.

Categories

Proactive actions are organized into four areas:

AreaWhat it surfaces
Tune alertsNoisy, missing, or mis-thresholded alerts revealed by how real incidents actually fired
Improve observabilityGaps in metrics, logs, or traces that slowed an investigation down
Fix codeCode-level changes that would address a recurring root cause
Improve testingTests that would have caught a regression before it reached production

How they work

  1. Surfaced. Candidate actions are derived from the evidence and root causes in completed investigations.
  2. Grounded. Each action links back to the investigation(s) it came from, so you can see why it's being recommended.
  3. Deduplicated. Related recommendations are consolidated so the list stays a short, current set rather than an ever-growing backlog.
  4. Reviewed. You review, approve, and act. Nothing changes in your systems automatically; Autoheal suggests and the human decides.

Lessons from each incident collect into a focused list of improvements instead of being lost once the incident is resolved.

Lifecycle

Every proactive action moves through a simple set of states:

StateMeaning
SuggestedThe action has been surfaced and is waiting for your review. This is where you triage the list.
ExecutedYou've acted on the action (or marked it done). It drops out of the open queue.
DismissedYou declined the action. It's a terminal state — the action won't be suggested again.
SupersededA newer, related action replaced this one during deduplication, so the earlier version is archived automatically. You don't act on superseded actions; they're kept only for history.

Suggested actions are the only ones that need your attention. Everything else has either been handled or consolidated away.