Understanding investigation patterns
I observed 12 engineers during active incident responses and mapped their navigation patterns. The analysis revealed three critical friction points:
Signal clarity
Teams monitored only 15-20% of available metrics, but couldn't filter noise effectively
Ownership clarity40% of investigation time was spent identifying which team owned each failing service
Faster decisions
Engineers made a lot of context switches per investigation, resetting understanding each time



