Observability Domain

Overview#

A platform supporting multi-agency emergency operations must stay online and auditable under exactly the conditions most likely to stress it: major incidents, jurisdiction handovers, and compliance reviews. The Observability domain provides the operational visibility needed to keep the platform healthy, manage incidents from detection through resolution, and maintain the audit trails required for regulatory and legal scrutiny.

Interactive Architecture Topology

14 nodes18 signal paths

Select any node on the canvas or run Simulate Flow to trace upstream dependencies and downstream signal paths.

Entry points:

Key Features#

Event tracking across system, user activity, investigation, security, and compliance categories
Incident creation, acknowledgement, escalation, and resolution workflows
System health monitoring with component status and health score calculation
Compliance tracking with regulatory audit trails and risk assessment
Multi-agency incident coordination for cross-jurisdiction operations
Law enforcement context support including emergency response and court integration
System overview dashboard with health, component, and event summaries
End-to-End Trace Context: W3C trace context flows end to end through the platform, so a single request can be followed across services.

Use Cases#

Relevant sectors include law enforcement, critical infrastructure, and intelligence agencies.

Monitoring platform health and component status in real time for proactive issue detection
Managing operational incidents from creation through escalation and resolution
Tracking compliance status and maintaining regulatory audit trails
Coordinating multi-agency incidents across jurisdictions during emergency operations

Integration#

The Observability domain integrates with Monitor for AI-orchestrated monitoring, Performance for metrics tracking, Investigation for case context, Evidence Object for chain of custody, and SIEM Connector for security event integration.

Open Standards#

OpenTelemetry (OTLP): The domain integrates with OpenTelemetry-compatible backends (Tempo, Jaeger) to collect and query distributed traces, using the OTLP-aligned trace query API with tenant-scoped span filtering and service metadata synchronisation.
W3C Trace Context: Every inbound request is processed by a dedicated middleware that parses and emits traceparent and tracestate headers in strict conformance with the W3C Trace Context specification, propagating 32-hex trace identifiers to all downstream calls and audit records.
OAuth 2.0 and JWT Bearer Token: Token-based authentication protects typed, auditable read and write workflows across the platform.
OWASP Application Security Verification Standard (ASVS) v4, V7.1.1 and V7.1.2: Audit-log creation enforces the ASVS logging controls; caller-supplied event metadata undergoes PII redaction before persistence, as explicitly annotated in the service code.
Common Event Format (CEF) / Log Event Extended Format (LEEF) / Syslog (RFC 5424): The SIEM Connector integration consumed by the Observability domain supports CEF, LEEF, and syslog as ingest source formats, enabling interoperability with ArcSight, QRadar, and standard syslog pipelines.
OAuth 2.0 (RFC 6749) / Bearer Token (RFC 6750): Access to observability trace endpoints is gated on bearer JWT tokens with explicit scope checks (argus:observability:read), following the OAuth 2.0 bearer token framework.
ISO 8601 / RFC 3339: All event, incident, metric, and compliance timestamps are serialised as ISO 8601-compliant strings, ensuring interoperability with external audit and reporting tools.

Last Reviewed: 2026-10-28 Last Updated: 2026-10-28