April 2026 Summaries

Claude Code, an AI agent for coding, has become widely adopted across engineering teams, yet many lack visibility into its operations and costs, akin to running without essential metrics and logs. While Claude Code generates structured telemetry data, it does not provide a direct destination or dashboard for analysis. Coralogix addresses this gap by integrating with Claude Code's OpenTelemetry support, enabling real-time streaming of metrics and logs into existing observability pipelines. This integration allows teams to gain insights into token usage, model costs, code impact, and session-level activity, transforming raw telemetry into actionable insights. As a result, teams can identify inefficiencies, optimize model usage, and maintain predictable costs while ensuring that AI coding agents are treated as integral parts of the infrastructure. This shift from reactive to proactive management allows for better control and understanding of AI-driven activities and expenditures within organizations.

Coralogix and Atlassian have collaborated to enhance incident response workflows by integrating Coralogix's full-stack observability capabilities directly into Atlassian's Jira Service Management. This integration aims to address the inefficiencies in incident response by providing a unified platform where teams can detect, investigate, and resolve issues seamlessly with AI-driven analysis. By utilizing Coralogix's observability tools, which include logs, metrics, traces, and security events, alongside Atlassian's operational management capabilities, the integration enables context-rich incident investigations, AI-driven root cause analysis, and automated post-incident reviews. This streamlined approach reduces the time to resolution, lowers the cognitive load on engineers, and allows for continuous improvement without additional processes. The architecture of Coralogix ensures that observability costs remain predictable as organizations scale, providing full data visibility without compromising on depth or budget. Overall, this collaboration between Coralogix and Atlassian offers an efficient, AI-assisted workflow that enhances organizational intelligence and incident management within the Atlassian ecosystem.

Agentic coding tools like Claude Code and Codex have become integral to software development workflows, shifting from mere assistants to critical dependencies within the production pipeline. This rapid adoption of AI tools has increased the rate of change in development processes, amplifying inefficiencies and necessitating a new approach to observability in coding environments. By leveraging OpenTelemetry data, developers can gain insights into metrics such as token usage, tool latency, and acceptance rates, allowing them to optimize and scale their use of AI tools effectively. The 2025 DORA Impact Report highlights a potential 2.1% productivity increase in individual developers with a 25% rise in AI adoption, though the real value lies in understanding the tools' behavior within workflows. Observability platforms like Coralogix enable teams to treat their development processes as systems, identifying bottlenecks and inefficiencies while correlating AI usage with development performance metrics. This approach allows teams to move beyond intuition, using data to make informed decisions about AI integration and ultimately enhancing the software delivery process.

In the evolving digital landscape, APIs have become essential security products rather than mere connectors, forming the backbone of various industries like Fintech, SaaS, and E-commerce. This shift has also made APIs the fastest-growing attack surface, with fragmented security operations often failing to prevent incidents efficiently. To address this, a "Security Trifecta" comprising AWS, Wallarm, and Coralogix has emerged, offering a cohesive approach to security by integrating protection at the infrastructure level, detailed API threat detection, and actionable intelligence through log correlation. AWS provides resilient infrastructure, Wallarm specializes in identifying API-specific threats, and Coralogix enhances observability, allowing for quicker threat detection and response. This integrated approach enhances security by bridging the gap between traditional WAFs and API security, ensuring businesses can protect against both obvious and sophisticated threats while maintaining operational efficiency.

Kotak811, a digital banking platform by Kotak Mahindra Bank, has significantly enhanced its observability capabilities by partnering with Coralogix to handle the challenges posed by rapid transaction growth and data overload. Since its 2017 launch, Kotak811 has become the primary growth driver for the bank, accounting for 70% of new customer acquisitions. However, traditional monitoring tools proved inadequate for managing the platform's telemetry data, leading to delays in identifying critical issues. Coralogix's comprehensive observability solution, which includes telemetry data standardization using OpenTelemetry, serverless log shipping via AWS, and real-time data processing with Streama©, has enabled Kotak811 to transform its operational strategy. This shift not only reduces the time to detect and address issues but also lowers observability costs by 30%. The transition involved a five-phase implementation process, which integrated observability into the CI/CD pipeline, allowing new microservices to be "born observable." As a result, Kotak811's engineering team can now focus on enhancing the customer experience and maintaining the platform's digital-first reputation while achieving a 90-95% reduction in Mean Time to Detection (MTTD).

Many organizations deploying AI face challenges not with AI models themselves, but with the underlying data, as approximately 60% of AI projects are abandoned due to a lack of AI-ready data, according to Gartner. This issue extends to observability data, which is highly valuable but traditionally structured for human use, not for AI consumption. Coralogix aims to transform observability by developing an AI-ready data layer that allows AI agents to interact with telemetry data conversationally, enhancing operational intelligence across various organizational roles. This involves a shift from traditional query-based interactions to dynamic, context-aware conversations facilitated by their DataPrime query language and living schema architecture. The approach enables comprehensive data access without the need for costly indexing, ensuring that AI agents can efficiently analyze and correlate data across different domains. By organizing data into governed domains, Coralogix provides a robust framework for AI-driven workflows, leading to improved pattern recognition and operational excellence, positioning their platform as a key enabler of next-generation AI capabilities.

AI coding tools like Claude Code, Codex, and Gemini are increasingly integrated into developers' workflows, capable of writing and refactoring code, running commands, and opening pull requests. However, their usage introduces challenges in understanding productivity, control, and cost. Coralogix's Code Agent Observability aims to address these by providing comprehensive visibility into AI agent usage, including real-time token consumption, model usage, and code impact, all without additional setup for teams using OpenTelemetry-supported agents. This solution enables organizations to track AI-generated code suggestions, session activities, and the overall cost-effectiveness of AI tools, integrating seamlessly with existing observability systems to offer insights into whether AI usage correlates with improved outcomes like faster incident resolution or enhanced code quality.

Coralogix's introduction of the DataPrime Expression Language (DPXL) for TCO routing marks a significant shift in data observability by allowing programmable routing at the point of data ingestion. Previously, routing decisions were limited to broad fields like application, subsystem, and severity, leading to imprecise data handling and increased costs. With DPXL, teams can now create fine-grained routing policies based on any field in the event payload, including nested and custom fields, enabling more precise data discrimination and cost-effective storage decisions. This advancement allows routing by content rather than just source, aligning storage costs with the actual business value of the data. By integrating DPXL into the Coralogix pipeline, organizations can make informed cost decisions at the most impactful moment, before data is stored, thereby reducing unnecessary expenses and improving cost management.

Observability is evolving beyond its traditional role of monitoring systems and reducing downtime to become a crucial decision-making tool for businesses. This transformation is driven by the need to handle dynamic, high-cardinality data that directly impacts user experience and revenue. Traditional observability platforms struggle with this due to architectural limitations, such as predefined schemas that restrict access to critical data dimensions like user-level metrics. Coralogix addresses this by storing all data fields raw and applying structure at query time, enabling real-time correlation across logs, metrics, and business contexts without predefined constraints. This approach allows for more comprehensive insights into system behavior and its business impact, facilitated by AI agents like Olly, which operate on a full, schema-free data surface. Consequently, observability is shifting from being a monitoring tool to serving as a primary decision layer that connects system behavior to business outcomes.

Digital banking is under increasing regulatory scrutiny, demanding robust observability systems capable of providing audit-ready evidence to comply with frameworks like DORA, PCI-DSS, and GDPR. Traditional observability platforms, which often rely heavily on indexing and rehydration, can be inefficient and costly, especially when dealing with compliance data. Coralogix addresses these challenges by transforming observability into a system of record, allowing for real-time querying and storage of both operational signals and long-term compliance data without the need for rehydration. This approach enables banks to maintain comprehensive datasets, manage costs, and provide immediate access to historical data in the required format and integrity. Furthermore, Coralogix enhances service level objectives (SLOs) and service mapping, thereby improving reliability and understanding of complex banking architectures and their dependencies. As AI becomes more integrated into banking systems, Coralogix's AI Center offers real-time monitoring and compliance reporting, ensuring traceability and auditability of AI interactions. The platform also features Olly, an autonomous investigation tool that streamlines post-incident reviews by automatically generating structured incident narratives, shifting the focus from reactive reporting to continuous oversight. Overall, Coralogix promotes observability as a fundamental institutional control, supporting banks in navigating regulatory demands with minimal friction.

The integration of Coralogix MCP Server with real user monitoring (RUM) data allows AI coding assistants to streamline the debugging process by using natural language queries to access live data, significantly enhancing the speed and efficiency of investigations into frontend issues. This innovative approach bridges the gap between investigation and resolution, enabling AI tools to not only identify issues like JavaScript errors and performance bottlenecks but also to provide contextual insights directly within the code editor. This closed-loop system allows for rapid triage and problem resolution by correlating data with specific components within the codebase, thus facilitating quicker transitions from identifying problems to implementing solutions. By allowing AI clients to query RUM data directly, engineers can focus more on reasoning and less on navigating disparate data sources, making it easier to address performance regressions, network failures, and user interaction issues across web and mobile platforms.

The text discusses the transition from manual instrumentation to automated observability in distributed systems, focusing on the use of eBPF technology through Coralogix OBI (OpenTelemetry eBPF-based instrumentation). Traditionally, gaining deep visibility into systems required significant engineering effort and code modifications, but eBPF technology enables "zero-code" automation, capturing trace spans for services without altering application code. OBI, a vendor-neutral agent, operates at the Linux kernel level, providing comprehensive observability across Kubernetes clusters by automatically detecting services and monitoring encrypted traffic with minimal system overhead. This approach aligns with OpenTelemetry standards, ensuring compatibility with the broader observability ecosystem, and offers significant advantages for modern infrastructure management by reducing maintenance burdens and providing instant insights into performance across diverse environments. The text highlights the strategic benefits of eBPF-driven observability, particularly in managing complex, heterogeneous environments where traditional methods are impractical, and previews a forthcoming blog post that will explore the application of these principles to database latency issues using Couchbase as an example.

A recent security advisory details a sophisticated phishing campaign leveraging the OAuth Device Code Authentication flow to breach Microsoft 365 accounts globally, bypassing multi-factor authentication entirely. This campaign, identified as "EvilToken," employs an AI-driven Phishing-as-a-Service toolkit that generates live device codes to exploit the device code authentication mechanism. Attackers craft personalized phishing lures, such as fake invoices or document notifications, which trick victims into authorizing their session on legitimate Microsoft login portals. Once the device code is entered, attackers obtain OAuth tokens to access email, files, and contacts, allowing them to conduct email exfiltration, create malicious inbox rules, and persist access through device registration. The campaign's infrastructure avoids detection by routing phishing links through legitimate serverless platforms and compromised domains, while automated post-compromise operations use Microsoft Graph API for rapid data exfiltration and lateral phishing. The advisory emphasizes the need for organizations to enhance security measures, such as blocking cloud-hosted IP addresses for authentication and enabling token protection, to mitigate such identity-based attacks.

Capital markets face challenges with traditional observability systems that rely heavily on indexing, which is costly and limits visibility, particularly during unpredictable market events. Indexing models require all data to be stored upfront, resulting in high costs and delayed access to necessary information, as well as rehydration fees when accessing archived data. Coralogix offers a solution by processing all telemetry data through an in-stream pipeline, allowing for real-time parsing, enrichment, and classification before routing and storage decisions are made. This approach eliminates the need for default indexing, enabling on-demand querying and reducing costs associated with data storage and retrieval. Coralogix's architecture allows for direct querying against cloud storage without rehydration delays, ensuring instant access to historical data and full data ownership in compliance with regulations. By transforming raw data into contextualized and structured formats in real-time, Coralogix enhances query flexibility, reduces storage costs, and improves the efficiency of post-trade analysis and compliance checks, positioning itself as a modern alternative to traditional observability models in capital markets.