Asking Questions
How to phrase questions that get you fast, useful answers.
Escher works with plain English. You don't need a query language. But there are a few patterns that consistently produce better Canvases.
Three things that make a question great
1. Be specific about scope
| Less useful | More useful |
|---|---|
| "What's our cloud cost?" | "What's our AWS prod cost for the last 30 days, broken down by service?" |
| "Are we secure?" | "Which production S3 buckets allow public read access?" |
| "What changed?" | "What deployments and config changes happened in the last 24 hours, ranked by risk?" |
The more concrete the scope (account, environment, time window, severity), the more direct the Canvas.
2. Ask for the answer, not the data
Escher does the analysis for you. You don't need to ask for raw data — ask for the conclusion.
| Avoid | Try instead |
|---|---|
| "Show me the IAM roles." | "Which IAM roles have admin access in production?" |
| "List all S3 buckets." | "Which S3 buckets have public access enabled?" |
| "Get the EC2 cost data." | "Why did our EC2 cost increase this week?" |
3. Add a "why" or "what to do"
Escher is good at correlating signals. Ask it to.
"Why did our bill spike last week, and what was the responsible change?"
"Are we SOC2-ready, and what gaps need to close before our audit?"
"What caused the latency spike yesterday, and which deployment correlated with it?"
The shape of an answer
Every answer comes back as a Canvas — a structured response with:
- A direct conclusion (one or two sentences)
- Supporting findings, organized by what matters most
- Citations (links to the exact log, config, billing line, or event)
- Optional next-step actions you can approve
You can read a Canvas in the app, or export it as PDF for sharing or audit (JSON and Markdown exports are on the roadmap).
Question patterns by domain
| Domain | Try | Page |
|---|---|---|
| Cost | "Why did the bill spike?" "What's our top waste?" | Cost questions |
| Security | "What's exposed?" "Who has admin?" "Is this safe?" | Security questions |
| Compliance | "Are we SOC2-ready?" "Which controls fail?" | Compliance questions |
| Incidents | "What caused this?" "What changed?" "What's the blast radius?" | Incident questions |
What Escher can't do (yet)
Escher is great at questions about your existing estate. It's not a replacement for:
- Live alerting — for "wake me up at 2am if X breaks," use your existing observability tools
- Custom code generation — for "write me a Terraform module," use your IaC workflow
- Real-time streaming queries — Escher reasons over a recent map, not a live event stream
Escher fills the gap between dashboards and engineers: the questions that take a human 30 minutes to answer manually become 30-second Canvases.