01
Foundation
Create an Application
Define the investigation boundary: the business Application, its services and the context the LLM needs to investigate correctly.
Loading Home dashboard…
Workspace
Tools
Create and manage investigation tools and Application assignments.
DEV / SUPERUSER
Tool Testing Lab
Run the real Tool executor without an Investigation or LLM call. Review the outputs yourself.
Select a Trace Tool. The suite checks all enabled Trace Tools in its Application, sequentially: 15m incident, explicit 60m baseline where supported, LLM Evidence, and one focused trace per source. No LLM calls.
Change Intelligence sources
Choose multiple existing Application Tools. Ordinary operations use a single Tool.
JSON Request — LLM Tool Choice format
NO LLM CALLS
Topology
A global topology workspace is coming soon. Application topologies remain available in Applications.
Loading Triggers…
Loading Notifications…
Workspace
Applications
Define investigation scope, observability tools and dependencies.
Investigation Platform journey
How to investigate incidents
From an empty workspace to automatic, cross-Application incident investigation.
9 short steps
02
CData access
Create Connections
Connect Kubernetes, Elastic/OpenSearch, Prometheus, LLM providers and the other systems that hold investigation evidence.
03
TInvestigation scope
Create Tools in the central Tools workspace
Create a Tool once in Tools, assign it to one Application, then configure any Application-specific discovery before enabling it for investigations.
04
NCommunication
Configure Notifications
Create Application-owned Channels and Rules so the right team receives the investigation conclusion, evidence and recommended actions.
05
⚡Optional automation
Connect Triggers
If you want automatic investigations, create an Inbound API Account and Trigger Source for the Application.
06
XCross-Application Investigation
Link dependent Applications
Declare downstream Application relationships. The platform can then hand the investigation to the correct Application when evidence crosses a boundary.
07
SData protection
Configure Security rules
Set Sensitive Data policies so logs and evidence are sanitized before they are sent to the LLM.
08
RValidate
Run an Investigation
Start manually first, review the timeline and manual verification steps, then enable automatic flows when the scope behaves as expected.
09
↗Operate
Review Analytics & Reports
Track token use, cost and investigation runtime, and export reports when you need to share Investigation results.
Ready
Your incident investigation workflow is connected end to end.
Integrations
Connections
Reusable provider connections with encrypted credentials.
Investigation history
Investigations
Review automatic Investigations and start manual investigations when your role allows it.
LLM observability
AI Analytics
Track model token consumption, estimated spend and investigation runtime over time.
Last 7 days
Usage
Input tokens
Prompt/context tokens consumed by each model.
Usage
Output tokens
Visible generated output; reasoning/thinking is shown separately when the provider exposes it.
Usage
Thinking / extra tokens
Provider-reported tokens that are not included in the visible input/output counters, such as Gemini thinking tokens.
Usage
Total tokens
Total usage reported by the model provider, including any provider-specific extra tokens.
Estimated spend
Model cost
Historical cost from immutable per-investigation pricing snapshots.
Performance
Average investigation time
Average end-to-end duration for completed or failed investigations by model.
Settings
General preferences, security and investigation behavior for UTU Engine.
Loading general settings…
Loading Sensitive Data settings…
Loading Log analysis settings…
Loading Investigation Triggers…
LLM pricing
Prices are stored per 1,000,000 tokens. Thinking/reasoning is billed at the output rate. Every LLM step snapshots the active price, so changing prices does not rewrite historical Investigation costs.
Model price list
All discovered models and their token prices. Changes affect new investigations.
LLM pricing
Create model pricing
Configure token prices per 1,000,000 tokens.
Access control
Users
Manage platform users, roles and application access.
⌘ K