See when your defences held, and when your site quietly degraded
Outcomes are dated, evidence-backed statements about a window of time on your site: a probe storm your firewall rejected at the edge, a bot surge your site absorbed, or pages that stayed 200 but took twenty seconds or arrived without their content, and when it ended. In the app, the API, MCP, the CLI and one line in the weekly report.
Alerts have always told you when something went wrong. They have never told you when something went right, and they have been quiet about the kind of failure that never raises an error: pages that still answer 200 but take twenty seconds, or arrive with their content missing because an upstream API is down.
Outcomes fix both. An outcome is a dated statement about a window of time on one site, built from the evidence and nothing else, with a valence:
- Handled well. "3 IPs sent 9,014 credential-hunting requests between 02:20 and 04:00. Your firewall rejected 100% of them at the edge. Visitors were not affected." Or: "Bot traffic ran at 4× normal for 90 minutes; visitors saw no slowdown." These are the nights your setup did its job, recorded so you can see them.
- Degraded. "Pages took more than 5 s to load for visitors from 01:15 (normally ~210 ms). 184 visitors gave up waiting. Status codes stayed 200, so this looks like a slow upstream, not an outage." Or pages served to visitors markedly smaller than usual for that hour of the week, which is what missing content looks like in a log. Visitor latency is measured on visitors only, so a burst of one-millisecond bot rejections can no longer hide a slow origin behind a healthy-looking average.
- Recovered. "Back to normal at 09:10 after 8 hours."
A multi-hour episode is one card that keeps updating, not a new alert every check. Degraded outcomes reach you like a warning alert through your existing streams and digest; one that has been open for 30 minutes goes to engineering subscribers straight away. Handled-well outcomes are never emailed as alerts: they appear in the app, and the weekly report carries one line, "Your firewall blocked 2 probe storms this week; visitors were never affected", when there is something to say, and nothing when there is not.
A wrong "you're fine" is worse than silence, so positive outcomes are only recorded at high confidence, which needs about two weeks of history for that hour of the week. An empty list means nothing rose to the bar, not that nothing was checked.
Outcomes are on the dashboard's What happened strip and the Alerts page's Handled well filter, in the public API as GET /public/v1/websites/{id}/outcomes (typed in the OpenAPI description), in MCP as get_outcomes and in the CLI as salience outcomes. See Outcomes help.