🔍Netflix Builds Knowledge Graph to Cut 4-Hour Regression Investigations

Your incident triage is about to get a lot faster

Netflix is building a knowledge graph that maps how its systems relate to each other, and the point is to stop engineers from spending hours reconstructing that picture during incidents. Investigating a typical application regression eats around four hours, and most of that goes to figuring out which service touched which. Netflix wants those relationships written down explicitly. If you run on-call, this is the part to care about. The Observability Ontology defines entities like applications, incidents, deployments, alerts, and infrastructure dependencies, plus the links between them, using RDF, OWL, SHACL, and SPARQL. A correlation engine then checks 13 signal types, including log errors, metric anomalies, traces, deployments, config changes, and code changes, and ranks likely causes by temporal proximity and severity. AutoRCA, Netflix's internal agentic root-cause tool, sits on top of this graph. The scale is the reason this matters. Netflix handles more than 2 billion requests a day and over 38 million real-time logging events per second. During the November 2024 fight, it supported about 65 million concurrent streams. Its MELT data (metrics, events, logs, traces) already exists, so the missing piece was structure, not telemetry. The graph is stored in QuipuDB, a distributed RDF database built on Rust's redb engine. Worth watching: whether the ranked hypotheses hold up outside Netflix's own stack. The approval gate stays with humans, which is the right call for now.