---
title: 'Evidence and correlation'
description: 'The immutable Evidence model with quality scoring, and the correlation engine that links related symptoms to a probable root cause with explicit confidence.'
section: 'Operations Center'
weight: 6
related:
  - detectors-and-canons
  - massive-incidents
---

## Evidence Model

### What Evidence Is

`Evidence` is a structured proof on the basis of which the system creates, updates, or verifies an Issue.

Evidence can be:

- automatically computed;
- received from a device;
- imported from an external system;
- added by a user;
- generated by a specialized report;
- attached as a document, photo, or comment.

### Evidence Structure

```yaml
evidence_id: EVD-830129
issue_id: OHM-2026-001842
type: detector_finding
source:
  provider: analyze_station
  detector_id: archive.tail_gap.v3
  detector_version: '3.2.1'
observed_at: '2026-07-23T04:00:00Z'
created_at: '2026-07-23T04:03:12Z'

payload:
  missing_hours: 73
  coverage_valid: 0.91
  last_valid_hour: '2026-07-20T03:00:00Z'

quality:
  completeness: 1.0
  freshness: 0.98
  consistency: 0.96
  confidence: 0.98

links:
  report: '/reports/analyze-station/5690'
```

### Evidence Types

| Type                      | Example                                 |
| ------------------------- | --------------------------------------- |
| `detector_finding`        | detector result                         |
| `telemetry_sample`        | telemetry fragment                      |
| `archive_window`          | summary of an archive period            |
| `event_log`               | device event log                        |
| `configuration_snapshot`  | configuration snapshot                  |
| `operator_comment`        | dispatcher comment                      |
| `field_report`            | field crew report or act                |
| `photo`                   | photograph of equipment                 |
| `external_ticket`         | link to an external ticket              |
| `verification_result`     | confirmation of remediation             |
| `root_cause_confirmation` | confirmation of the root cause          |
| `knowledge_application`   | application of a knowledge base article |

### Evidence Quality

Quality is computed for each Evidence:

$$
Q_{evidence} =
w_c C +
w_f F +
w_s S +
w_t T
$$

where:

- $C$ — completeness;
- $F$ — freshness;
- $S$ — consistency;
- $T$ — trust in the source;
- $w_c + w_f + w_s + w_t = 1$.

Recommended base weights:

| Component                   | Weight |
| --------------------------- | -----: |
| $w_c$ — completeness        |   0.30 |
| $w_f$ — freshness           |   0.25 |
| $w_s$ — consistency         |   0.25 |
| $w_t$ — trust in the source |   0.20 |

The result is normalized to the range `0` to `1`.

### Evidence Immutability

Original Evidence is never edited retroactively. A correction creates a new version or a separate corrective Evidence.

This ensures:

- auditability;
- reproducibility;
- protection of history;
- correct review of disputed cases;
- the ability to recompute.

## Event Correlation and Root Cause

### The Correlation Task

Correlation prevents the creation of many independent Issues for the same technical cause.

The system analyzes:

- asset match;
- temporal proximity;
- topological dependency;
- shared firmware;
- shared gateway;
- shared communication operator;
- shared region;
- shared server queue;
- symptom sequence;
- historical links;
- confirmed root causes of past cases.

### Correlation Levels

#### Within a Single Asset

Several symptoms are consolidated around a primary canon.

```mermaid
flowchart TD
  A["stale_communication"] --> C{"Correlation within the asset"}
  B["no_hourly_archive"] --> C
  D["battery_unknown"] --> C
  C --> R["Root issue stale_communication"]
  C --> S1["Secondary signal no_hourly_archive"]
  C --> S2["Secondary signal battery_unknown"]
```

#### Across Assets

Similar problems are grouped into a massive incident.

```mermaid
flowchart TD
  A["38 devices"] --> G{"Grouping"}
  B["One firmware version"] --> G
  C["One time window"] --> G
  D["One failure type"] --> G
  G --> M["Massive Incident firmware_regression"]
```

#### By Dependency

Problems of child devices are linked to the failure of a shared component.

```mermaid
flowchart TD
  A["Gateway-17 unavailable"] --> B["12 correctors without communication"]
  B --> C["12 archives not delivered"]
  C --> D["One dependency incident"]
```

### Correlation Score

An explainable model is used to assess the strength of a link:

$$
S_{corr} =
w_a A +
w_t T +
w_p P +
w_c C +
w_h H
$$

where:

- $A$ — asset or dependency match;
- $T$ — temporal proximity;
- $P$ — pattern match;
- $C$ — shared context;
- $H$ — historical confirmation of the link.

Example weights:

| Factor                          | Weight |
| ------------------------------- | -----: |
| $A$ — asset or dependency match |   0.30 |
| $T$ — temporal proximity        |   0.20 |
| $P$ — pattern similarity        |   0.20 |
| $C$ — shared context            |   0.15 |
| $H$ — historical confirmation   |   0.15 |

The merge threshold is set per problem class. A more conservative threshold is allowed for critical security signals.

### Root Cause Class

OHM uses a managed catalog of root causes:

| Class          | Examples                               |
| -------------- | -------------------------------------- |
| Power          | battery, power supply, converter       |
| Communication  | network, SIM, signal, operator         |
| Firmware       | regression, incompatibility            |
| Configuration  | erroneous parameter                    |
| Registry       | duplicate, ghost, incorrect binding    |
| Sensor         | failure, drift, stuck readings         |
| Metering       | metrological problem                   |
| Infrastructure | server, queue, gateway                 |
| Integration    | API, format, mapping                   |
| Human          | error in an action or process          |
| Environment    | temperature, moisture, external impact |
| Security       | integrity or access violation          |
| External       | third-party system or supplier         |
| Unknown        | insufficient data                      |

### Root Cause Statuses

| Status                | Meaning                                      |
| --------------------- | -------------------------------------------- |
| `hypothesis`          | automatically proposed hypothesis            |
| `under_investigation` | the hypothesis is being verified             |
| `probable`            | confirmed by several independent indicators  |
| `confirmed`           | confirmed by an authorized user and Evidence |
| `rejected`            | the hypothesis has been rejected             |
| `unknown`             | the root cause has not been established      |

### Root Cause Confidence

Confidence in a hypothesis is computed from the aggregate of evidence:

$$
C_{root} =
\frac{
\sum_{i=1}^{n} r_i q_i a_i
}{
\sum_{i=1}^{n} r_i
}
\cdot K_{independence}
$$

where:

- $r_i$ — reliability of the detector or source;
- $q_i$ — Evidence quality;
- $a_i$ — consistency of the Evidence with the hypothesis;
- $K_{independence}$ — source independence coefficient.

If several pieces of Evidence originate from the same source data set, they are not considered fully independent.

### Operational Confidence

`Operational Confidence` indicates how certain the system is that an Issue is a real and correctly classified problem.

$$
C_{issue} =
w_d D +
w_e E +
w_r R +
w_h H -
w_x X
$$

where:

- $D$ — detector reliability;
- $E$ — Evidence quality;
- $R$ — correlation consistency;
- $H$ — historical confirmation rate;
- $X$ — penalty for contradictions and lack of data.

Interpretation:

| Confidence | Level      | Action                                          |
| ---------: | ---------- | ----------------------------------------------- |
|     ≥ 0.85 | high       | automatic creation of an actionable Issue       |
|  0.65–0.85 | sufficient | Issue creation with standard triage             |
|  0.40–0.65 | limited    | review required                                 |
|  < 0.40 | low        | analytical signal, automatic actions prohibited |