Behavioral Correlation —
six teams, one coherent release.
ScienceLogic's Behavioral Correlation feature used ML to shift enterprise IT operations from reactive alert management to proactive service intelligence. I led design from research through the Colosseum Release — coordinating across six development teams while designing the feature itself.
Thousands of alerts. Almost no signal. Operators drowning in noise.
Enterprise IT operators managing complex hybrid environments were dealing with alert volumes that made meaningful triage nearly impossible. Behavioral Correlation used ML to identify patterns in that noise automatically, grouping related events into service-level insights operators could actually act on.
The design challenge was making that ML intelligence legible. Operators working under pressure don't have time to understand how a model works — they need to understand what it's telling them, fast, and trust that it's telling them something real. The sophistication had to be invisible.
Understand how operators actually work before designing the ML interface.
I started with operator research — not because the feature needed user research in the abstract, but because the ML interface needed to map to how operators already thought about their environment. If the correlation view used vocabulary or visual models that didn't match the operator's mental model, the intelligence would be there but the utility wouldn't.
How IT operators actually triaged events: the vocabulary they used, how they thought about service relationships, what signal looked like versus noise.
Early explorations translating ML model outputs into operator-legible representations. Goal: surfaces that feel like they're showing you something you already almost know.
From there I designed the correlation view to surface service relationships in terms operators already used — topology, dependencies, affected services — rather than exposing the ML model's internal representation.
Events grouped into behavioral patterns shown against service topology. Operators move from pattern identification to investigation without context switching.