Estate
Your services, owners, teams, dependencies, alerts, workloads, databases and repositories, where each link came from, what isn't placed yet, and how discovery never drops anything.
Estate (/estate, g e) is 3AM's map of what you run. Every incident starts here: an alert is mapped to a
service, its owner and team, its repositories and what depends on it.
Where it comes from
Discover (setup's last step, or Discover again here) asks every connection at once, each with a 45-second
limit (THREEAM_DISCOVER_TIMEOUT_S):
| Source | Contributes |
|---|---|
| CMDB (ServiceNow) | Services, owners, dependencies |
| Monitoring | Services, jobs, alert rules |
| Kubernetes | Workloads, and the service each workload's labels say it is |
| Argo CD | Applications, and the repository each is deployed from |
| Servers (SSH) | Applications and their hosts |
| Database connections | The service each names |
| Repositories | Code, CODEOWNERS |
| PagerDuty and the like | The services they know |
- One connection failing never empties the estate. A connection that fails or doesn't answer contributes what it said last time, marked last known with since when.
- Links say how they were made:
label,settinganddeployedare certain;nameandcodeownersare matches. Discovered from shows each connection, what it contributed and whether it answered.
Found, not placed yet
Nothing found is dropped. Repositories, alerts, workloads and databases that fit no service are listed with a best guess, and placed with one click (an estate override, so it survives every later discovery). A name another tool calls a service is a candidate, added by a person, never by discovery, because a service counts towards the licence.
Editing
Add a service, set its owner, team, criticality (tier 1–4), approvers and technologies, link what discovery missed,
or remove a wrong link. Overrides always win, and are kept in config/estate-overrides.json
(Configuration files). On a Keychain member, estate fixes may be
carried from the home.
Suggested dependencies
3AM suggests dependencies from incidents (two services failing together, causal discovery, sessions on a database a Study read). They're likely, never fact, until a person Confirms or Dismisses them.
API
GET /v1/estate, GET/PUT /v1/estate/overrides, GET /v1/estate/suggestions,
POST /v1/estate/suggestions/confirm|dismiss, POST /v1/discover (a job: poll GET /v1/jobs/<id>).
Impact and the lookback
The business report in your own money (what 3AM returned, where it came from, how the figures are made), saved as PDF, and the lookback over your last 90 days of incidents.
Study
Before anything breaks, 3AM rehearses every cause it could be asked to prove, records what normal looks like, reads who talks to whom, and lists exactly what stands in the way.