SYNTHETIC / ILLUSTRATIVE

Three incidents.
One evidence workspace.

These examples explain the investigation experience. They are not measured customer incidents or accuracy claims.

Network forwardingAPI authenticationKubernetes backend
ILLUSTRATIVE INVESTIGATION / 1

Network forwarding failure

inside.pcap · outside.pcap · firewall.log
WORKING

Connection initiation observed at ingress and egress.

BROKEN

Matching ingress initiation lacks an expected egress observation.

Probable forwarding boundary

Evidence: inside.pcap packet 104 · firewall.log line 28

Validate capture coverage, clock alignment, NAT, hardware offload and alternate paths before assigning cause.
ILLUSTRATIVE INVESTIGATION / 2

API auth drift after deployment

openapi.yaml · working.har · failing.har
WORKING

Bearer authentication · HTTP 201 · backend wait 42 ms

BROKEN

API-key evidence · HTTP 401 · backend wait 43 ms

Authentication response is the first measured difference.

Evidence: working.har entry 12 · failing.har entry 12 · OpenAPI /paths

Bearer presence does not prove token validity. Verify deployed policy, API version and the affected request.
ILLUSTRATIVE INVESTIGATION / 3

API errors after Kubernetes deployment

working-deployment.yaml · failing-deployment.yaml · events.log · gateway.har
WORKING

Previous image revision · ready backend · HTTP 200

BROKEN

New image revision · readiness failure · HTTP 503

Configuration changed; readiness and API failures are temporally associated.

Evidence: Deployment /spec/template · events.log line 18 · gateway.har entry 9

Temporal order alone does not prove the deployment caused the outage. Confirm service selectors, endpoint readiness and application logs.