Snapshot
- Company / Product: Hitachi Vantara
- Timeline: 2019–2021
- Role: UX Architect
- Scope: Strategy, Discovery, UX, Alignment, Execution
- Team: PM, Engineering, Data, Design
The Problem
Business Context
Hitachi Vantara’s core business was traditionally on-premise enterprise storage. As cloud adoption accelerated, local large enterprises shifted toward hybrid cloud infrastructure. Hitachi recognized an opportunity to extend monitoring beyond storage to help enterprises manage risk across hybrid systems.
User Context
- Excessive alert noise: Modern distributed systems generate high volumes of alerts, making it difficult to identify meaningful signals.
- Reactive operations: Monitoring tools surfaced issues after failure, forcing teams into reactive rather than proactive management.
- Fragmented visibility: Critical signals were spread across multiple tools and teams, slowing root-cause identification.
- Ambiguous ownership: Alerts lacked context around impact and causality, making it unclear which team should act.
Reframing the Problem
Initially framed as "using AI to reduce alert noise," we found that reducing alerts wasn't enough—teams lacked trust in opaque AI decisions. We reframed the goal as "augmenting human understanding" and building "operator confidence" by explaining how AI-driven decisions were formed.
Key Insight
The real problem wasn't too many alerts—it was lack of confidence in deciding which alerts mattered and why. Operators needed to understand the system's reasoning, not just trust its conclusions.
The Solution
Rather than just reducing alert volume, we built a system that helped operators understand, validate, and trust AI-generated insights through five key experience moments:
1. Understanding Why a Situation Exists
The change: Instead of isolated alerts, the system presented a chronological view of how a situation evolved.
The impact: This reduced skepticism towards "black-box" AI decisions and helped operators quickly validate whether an issue required action.
2. Making Relationships Visible Through Topology
The change: Each situation included a topological view showing how hosts, pods, containers, and services were related.
The impact: This allowed operators to reason about blast radius and dependency chains ("this pod hosts 3 containers, 2 are failing, feeding this service") instead of manually correlating resources.
3. Reducing Noise Through Situation-Based Grouping
The change: Repetitive alerts were grouped into "situations," making high-noise incidents scannable.
The impact: Operators could focus on emerging risk patterns rather than triaging individual alerts repeatedly. This reduced cognitive load and prevented alert fatigue.
4. Closing the Loop With Human Feedback
The change: Operators could mark false positives or validate issues directly through inline actions.
The impact: This created a feedback loop where the system learned from expert action, reinforcing trust by making operators active participants.
5. Scanning System Health at a Glance
The change: A customizable dashboard provided a 10,000-ft view of system health and prioritized risk.
The impact: Operators could quickly assess risk and prioritized attention without diving into individual alerts.
Design Process & Key Decisions
Here's how I approached three critical design challenges, the alternatives I explored, and why specific solutions won out.
Decision 1: Designing the Situation Timeline
The Challenge
Operators needed to understand why the AI grouped certain alerts into an actionable situation. Without this understanding, they defaulted to ignoring AI recommendations and manually triaging individual alerts.
What I Explored
- Confidence scores + ranking: Rejected. Operators found numeric confidence scores meaningless without context.
- Correlation graph (network diagram): Rejected. Required too much cognitive effort during high-pressure incidents.
- Chronological timeline with causal annotations: Selected. Matched operators' mental model of incident progression.
Why the Timeline Worked
- Matched mental models: Operators naturally think about incidents as "what happened first, then what broke."
- Made causality visible: Visual connectors showed relationships without requiring graph literacy.
- Enabled rapid validation: Operators could scan the timeline in seconds to confirm or reject the AI's reasoning.
Decision 2: Designing the Topology View
The Challenge
Operators needed to see how a failing container impacted a pod and downstream dependencies, but full topology graphs are overwhelming.
What I Explored
- Full infrastructure graph: Rejected. Too much visual noise.
- Situation-scoped topology: Selected. Only showed components directly involved.
- Alert overlay toggle: Added. Allowed operators to see "clean" topology first.
Why This Approach Worked
- Reduced cognitive load: Operators could immediately see what was impacted.
- Progressive disclosure: The toggle allowed layering of problems onto structure.
- Supported root-cause reasoning: Visual dependency tracing accelerated analysis.
Decision 3: Designing the Feedback Loop
The Challenge
Operators remained skeptical of AI decisions unless they could influence the system, but traditional ML retraining is slow and complex.
What I Explored
- Post-incident survey: Rejected. Low completion rates.
- Inline feedback actions: Selected. Single-click actions in the situation view.
- Integration with workbench: Added. Operators could tag missed situations in their existing workflow.
Why This Approach Worked
- Zero-friction interaction: Feedback in under 2 seconds.
- Psychological ownership: Operators felt like active participants.
- Closed the loop: Integrated feedback improved the system over time.
Strategy & Approach
Guiding Principles
- Operator confidence over automation: AI should support human judgment, not replace it.
- Transparency enables learning: The system must make signal relationships visible.
- Data context over raw data: Focus on explaining why something matters.
My Role
I led discovery research, UX strategy, and MVP definition. This included stakeholder interviews, customer sessions with operators/SREs, and UX workshops to map incident workflows.
Leadership & Influence
Cross-Functional Alignment
- Influence through artifacts: Used journey maps and concept prototypes to align PM, Engineering, and Data Science.
- Integrating with workflows: Worked to integrate feedback into the existing operator workbench, ensuring the product fit established workflows.
- Improving interpretability: Partnered with DS to ensure alert copy explained why a situation mattered.
Impact & Results
Operational Outcomes
- Faster incident response: Significant reductions in MTTR and MTTA.
- Meaningful noise reduction: Shifted from raw alert noise to meaningful situations.
Behavioral Impact
- More effective escalations: Fewer, better-informed tickets.
- Increased operator confidence: Operators trusted AI-driven detection enough to reduce manual alert maintenance.
Adoption Signals
- High engagement: ~90% of root-cause analyses received operator feedback.
- Validation at scale: Confirmed ability to support multi-tenant environments.
- Deep adoption: Operators requested deeper runbook integrations.
Reflections & What I Learned
- Explainability builds trust: AI needs explanation to be trusted. Operators need to understand, validate, and correct AI decisions.
- System context is key: topological visibility is everything in infrastructure.
- Human-in-the-loop: Feedback loops are critical not just for model training, but for user engagement and ownership.