LogsF-2284

Ticket cluster with no alert behind it — Vela Fintech AR sign-in

P3 · SUB-P1

Ack SLA remaining1100m 00sof 1440m 00s

Tickets without a linked alert

22 tickets

from ≤ 5 per 6h · +4.4×

Affected users

4,180

Vela Fintech AR · partner SSO

Cancels at risk

340

Modelled over 30 days

Detected

5h 40m ago

28 Aug 08:40 UTC

Attributable to

Adroit

The tool's own detection and join coverage. Never routed to a vendor.

Response

Detected

Detected
Acknowledged
Investigating
Routed
Resolved

1100 minutes left on the acknowledgement clock.

Discussion

0 messages

Not routed yet. Nobody outside this tool knows about this finding.

Description

22 Zendesk tickets in 6 hours all describe failing to sign in on Vela Fintech AR, and no active alert covers them. Per F2.6 this is treated as a detection gap rather than a service incident: the tool should have caught this before the users did. Firebase Auth shows a 4.1× rise in SSO handshake timeouts for the tenant, which no seeded rule currently watches.

Suggested action

Add a seeded rule on auth_success_rate scoped to tenant, then backtest it against the last 30 days before enabling.

Related logs

2 signals · expand a row for the event data

2026-08-28T08:40:00.000ZS-8760 COHORT DECOMPOSITION Unlinked ticket cluster — observed 22 tickets, expected ≤ 5 per 6h+4.4×

Detected: 28 Aug 08:40 UTC5h 40m ago
Detector: Cohort decomposition
Slice: Vela Fintech AR · category: sign-in
Confidence: 93%
Affected users: 22
Observed: 22 tickets
Expected: ≤ 5 per 6h
Deviation: +4.4×

Event dataZENDESKGET /api/v2/tickets/search200971mss-8760-00353

{
  "timestamp": "2026-08-28T08:40:00.000Z",
  "endpoint": "GET /api/v2/tickets/search",
  "requestId": "s-8760-00353",
  "status": 200,
  "latencyMs": 971,
  "request": {
    "metric": "Unlinked ticket cluster",
    "slice": "Vela Fintech AR · category: sign-in",
    "detector": "cohort",
    "window": "6h"
  },
  "response": {
    "observed": "22 tickets",
    "expected": "≤ 5 per 6h",
    "deviation": "+4.4×",
    "confidence": 0.93,
    "affected_users": 22,
    "columns": [
      "category",
      "tenant",
      "tickets",
      "first seen"
    ],
    "rows": [
      [
        "sign-in",
        "vela-ar",
        "22",
        "28 Aug 08:40"
      ],
      [
        "playback",
        "altiplano-pe",
        "7",
        "28 Aug 10:15"
      ]
    ]
  }
}

Query

SELECT category, tenant_id, count(*) AS tickets, min(opened_at) AS first_seen
FROM semantic.ticket WHERE linked_alert_id IS NULL
  AND opened_at >= now() - interval '6 hours'
GROUP BY category, tenant_id HAVING count(*) > 5 ORDER BY tickets DESC

2026-08-28T08:44:00.000ZS-8762 SEASONAL BASELINE Auth handshake timeout rate — observed 6.8%, expected 1.7%+4.1×

Detected: 28 Aug 08:44 UTC5h 36m ago
Detector: Seasonal baseline
Slice: Vela Fintech AR
Confidence: 90%
Affected users: 4,180
Observed: 6.8%
Expected: 1.7%
Deviation: +4.1×

Event dataFIREBASEPOST /bigquery/v2/projects/sony-one/queries200973mss-8762-00355

{
  "timestamp": "2026-08-28T08:44:00.000Z",
  "endpoint": "POST /bigquery/v2/projects/sony-one/queries",
  "requestId": "s-8762-00355",
  "status": 200,
  "latencyMs": 973,
  "request": {
    "metric": "Auth handshake timeout rate",
    "slice": "Vela Fintech AR",
    "detector": "baseline",
    "window": "6h"
  },
  "response": {
    "observed": "6.8%",
    "expected": "1.7%",
    "deviation": "+4.1×",
    "confidence": 0.9,
    "affected_users": 4180
  }
}

Clustered support tickets

3 matched

Cannot log in with my Vela account
ZD-48088 · Vela Fintech AR
5h 30m ago
Sign in loops back to start
ZD-48092 · Vela Fintech AR
5h 2m ago
Login not working since yesterday
ZD-48119 · Vela Fintech AR
3h 8m ago

Sample affected users

4e1a9c025f88b3d1