Root Cause Analysis (RCA) helps you trace the origin of data quality incidents across your data lineage. When an incident is detected on a validator, RCA identifies related incidents on upstream and downstream assets and visualizes the propagation path on an interactive lineage graph. This lets you quickly determine whether an issue originated in your pipeline or was caused by a problem further upstream.

Accessing RCA

Navigate to any incident group — for example, from the Incidents listing or a source's incident tab.
On the Incident Group Details page, click the Root cause tab (alongside Overview and Past groups).
The RCA lineage graph loads automatically.

Prerequisites

RCA requires no manual configuration, but the following must be in place for it to produce meaningful results:

Lineage data -- Field-level and/or asset-level lineage must exist for the assets involved. Without lineage edges, the RCA graph will only show the origin asset with no connections. For more information, see About Data Lineage.
Validators -- The source must have validators configured. Without validators, Validio cannot create incidents or track incident groups. The validator's window configuration (such as a 1-day tumbling window) determines the time range used for the analysis.
Catalog assets -- Sources referenced by incident groups must be linked to catalog assets. For more information, see Catalog Assets.

How RCA Works

When you open the Root cause tab for an incident group, Validio performs the following analysis.

Time Range

RCA computes a scoped time range based on the incident group's validator window configuration:

Start -- The incident group's first-seen timestamp minus one window period. For example, if the validator uses a 1-day tumbling window, the start is one day before the first incident in the group.
End -- The incident group's last-seen timestamp.

All subsequent analysis is scoped to this time range.

Incident Grouping

When an incident occurs on a validator, Validio assigns it to an incident group — a collection of consecutive incidents for that specific validator:

If the previous datapoint processed by the validator was also an incident, the current incident joins the same group.
If the previous datapoint was not an incident, a new group is created.

Related Incidents

Validio analyzes the lineage graph and active incidents within the computed time range to identify related incident groups. Related groups are categorized by their relationship to the origin incident — for example, incidents on the same source, incidents on upstream fields connected through lineage, or freshness incidents on downstream assets. See RCA Relationship Types for the full list.

Lineage Graph

RCA builds an interactive lineage graph centered on the origin asset. The graph traces field-level and asset-level lineage both upstream and downstream from the origin, includes all reachable assets that have related incidents, and overlays incident severity data on each node and field.

RCA Lineage View

The RCA view displays the same interactive lineage graph used on the main Lineage page, focused on the incident-related assets. The graph flows left to right, with upstream assets on the left and downstream assets on the right. Origin nodes are automatically set as anchors and highlighted in the graph.

Incident Indicators

Incident severity data is overlaid on the graph to help you quickly identify affected assets:

Node-level badges -- Colored badges on each node showing total incident count, tinted by the highest severity (red for high, orange for medium, yellow for low).
Field-level indicators -- When a node is expanded, individual fields show severity dots for field-level incidents.
Node background -- Nodes with incidents display a colored background matching the highest severity.

Interactions

Action	Result
Click a node	Opens the asset sidebar showing description, configuration, incidents, glossary terms, and tags.
Click a field	Opens the field sidebar with field-specific details.
Click an edge	Opens the edge sidebar showing upstream and downstream assets.
Expand a node	Shows individual fields within the node, with field-level incident indicators.
Focus mode	Select a node or field, then click the Focus button to isolate it and show only connected paths.
View in Lineage	Navigate to the full Lineage page with the current selection as an anchor, preserving the time range and incident overlay.

Anchors

Click the Anchors button in the toolbar to view a popover listing all origin nodes (the assets or fields where the incident originated). Clicking an anchor in the list centers the graph on that node.

Filters

The filter toolbar supports the same filters as the main Lineage page:

Search -- Free-text search on node names.
Glossary term -- Filter by assigned glossary terms.
Domain -- Filter by domain.
Tag -- Filter by tags.
Type -- Filter by asset type (e.g., Table, View).
Location -- Filter by database or schema path.
Source -- Filter by whether the asset is a Validio monitored source.

Matching nodes are shown in normal colors while non-matching nodes are dimmed. Click Clear to remove all filters.

RCA Relationship Types

RCA identifies the following types of relationships between incident groups. The relationship labels are not displayed directly in the UI — the graph layout (upstream/downstream positioning) and incident overlays communicate the relationships visually.

Within-Source Relationships

These connect incidents on the same source or asset.

Relationship	Example
A freshness validator on the same source also has incidents.	A row count validator throws an incident at the same time that a freshness validator stops receiving data.
A row count or volume validator on the same source also has incidents.	A row count validator drops significantly, and a mean validator tracking a numeric field shifts at the same time.
Another validator on the same source has incidents on a shared field.	A numeric validator tracking the mean of a field and another numeric validator tracking the maximum of the same field both detect anomalies.

Field Lineage Relationships

These connect incidents through field-level data lineage.

Relationship	Example
An upstream asset has incidents on a field that feeds into the origin field.	A validator tracking the mean of `total_sales_amount` on an upstream source and the mean of `total_sales_amount` on a source directly downstream.
A downstream asset has incidents on a field derived from the origin field.	A validator tracking the mean of `total_sales_amount` on a downstream source, caused by the current incident on the upstream source.
A SQL validator's referenced fields have incidents on upstream assets.	A custom SQL validator references a field from an external table, and that field has incidents on the upstream source.

Freshness and Volume Relationships

These connect incidents through asset-level lineage based on operational metrics.

Relationship	Example
An upstream asset has freshness incidents.	A freshness validator threw an incident upstream and likely caused the current freshness validator incident.
A downstream asset has freshness incidents.	Freshness validators downstream are throwing incidents as a result of the current freshness validator incident.
An upstream asset has volume or row count incidents.	A volume validator on an upstream source detected a drop, correlating with volume changes on the current source.
A downstream asset has volume or row count incidents.	Volume validators downstream are detecting changes caused by the current volume incident.