Data Layer

Integrations & Ingestion

Connect operational systems and transform fragmented evidence into structured incident context. Ingest from monitoring, ticketing, alerting, logs, and documentation sources.

Ingestion Architecture

Connector

→

Transport Layer

→

Canonical Normalizer

→

Schema Validator

→

Evidence Pipeline

Supported Sources

MazeLabs ingests from the tools your team already uses. Each connector normalizes vendor-specific formats into a canonical event schema before evidence compression.

AWS CloudWatch

Monitoring

Logs, metrics, alarms, and CloudTrail events

Datadog

Monitoring

APM traces, logs, infrastructure metrics, and monitors

New Relic

Monitoring

Application performance, distributed traces, and error analytics

PagerDuty

Alerting

Incident alerts, escalation policies, and on-call schedules

Jira / Atlassian

Ticketing

Incident tickets, post-mortems, and change requests

ServiceNow

Ticketing

ITSM incidents, change records, and CMDB topology

Application Logs

Logs

Structured and unstructured app logs via Fluentd, Logstash, or direct API

Runbooks & SOPs

Docs

Operational procedures, troubleshooting guides, and escalation docs

RCA Documents

Docs

Root cause analysis reports, post-incident reviews, and retrospectives

Custom APIs

Custom

Any REST or webhook-based source via the MazeLabs connector SDK

Connector Configuration

Each connector is configured using secure IAM roles or encrypted API tokens. Data is pulled via an isolated transport layer, normalized into the canonical schema, and immediately passed to the Evidence Compression Engine.

Example: Connect CloudWatch

curl -X POST https://api.mazelabs.com/v1/connectors/sync \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "connector": "aws-cloudwatch",
    "config": {
      "region": "us-east-1",
      "log_groups": ["/ecs/payments", "/ecs/gateway"],
      "time_range": "last_4h",
      "iam_role_arn": "arn:aws:iam::role/MazeLabsIngestion"
    }
  }'

Canonical Event Output

{
  "source": "cloudwatch",
  "type": "log_event",
  "service": "payments-api",
  "severity": "error",
  "timestamp_unix": 1778385060,
  "payload": {
    "message": "Connection pool exhausted",
    "active_connections": 150,
    "max_pool_size": 100
  },
  "provenance": {
    "log_group": "/ecs/payments",
    "region": "us-east-1"
  }
}

Private Execution Fabric

Security & Redaction