It is 2:10 in the morning. Forty alerts arrive within three minutes: API latency, queue depth, a batch job overrunning, two synthetic logins timing out, a disk warning that has been firing for a week. One of them is the cause. The rest are symptoms. The on-call engineer's first job is not to fix anything; it is to work out which alert to believe.
That is the failure mode of monitoring built from thresholds. Each monitor sees one metric and knows nothing about the others, so a single stalled consumer on an integration bus lights up every system downstream of it. The dashboard is accurate and useless at the same time.
What an ant colony knows
An ant colony finds the shortest path to food without any ant knowing the map. Each ant follows a simple rule, leaves a signal, and reinforces the signals it finds. The intelligence is in the swarm, not in any individual.
We built Platform Monitoring on the same principle. Hundreds of lightweight agents each watch a narrow slice of your platform: an endpoint, a queue, a scheduled job in IFS or SAP, a certificate, a real user journey from quote to invoice. When an agent sees drift it emits a signal. Neighbours with related views pick it up and re-probe their own slice, so attention concentrates where the disturbance is. Within a couple of minutes the agents around the fault have compared evidence (latency, error codes, queue depth, recent deployments) and voted on a root cause.
What reaches a person is one incident, with the suspected cause and the evidence attached, not forty alerts.
Three things that change
Coverage organises itself. Agents spend more time where things are changing and less where they are stable. New endpoints and jobs are discovered and adopted; nobody has to remember to add a monitor.
It degrades gracefully. There is no single collector to lose. If a region is down or some agents are blocked, the rest keep watching and keep agreeing.
It learns your normal. Baselines are per job, per hour, per season. Month-end load is not an incident. A Tuesday that looks like month-end is.
Remediation, with a human in the loop
Diagnosis is only half of it. A remediation agent drafts the fix: restart the consumer, replay the messages, re-route traffic, roll back the change. A person approves it in Teams or email, or a runbook you have pre-approved runs on its own. Either way the action is logged with the evidence behind it, so the post-incident note writes itself.
If you have an integration that everyone is a little afraid of, that is a good place to start. We will let the swarm watch it for two weeks and show you what it finds.