Skip to main content
Set up Rootly AI SRE and run a first investigation you can check against an answer your team already knows. Once the results hold up, let AI SRE investigate one alert class on its own.
Your Rootly account team enables AI SRE for each Rootly team. Opening AI SRE → Atlas (AI & Agents → AI SRE if your sidebar doesn’t have an AI SRE item) also requires an Incident Response seat on the currently selected team. If the selected team and your seat are both correct and AI SRE still doesn’t appear, contact your Rootly representative. See Manage User Permissions for management roles and the direct paths for admins without a seat.

​
Check That AI SRE Is Enabled

AI SRE has no self-service switch. Rootly checks it on the team you have selected, so AI SRE can be on for one team in your workspace and off for another. The Opt in to Rootly AI capabilities setting under AI SRE → Atlas → Global doesn’t turn AI SRE on or off. To check, open AI SRE → Atlas. The AI SRE card shows Enabled or Off. When AI SRE is enabled, alerts and incidents also show an AI SRE tab. Scheduled maintenance incidents never get the tab. If your sidebar has no AI SRE item, open AI & Agents → AI SRE instead: either AI SRE is off for the selected team, or the consolidated navigation isn’t enabled for your team yet. When AI SRE is off, AI & Agents → AI SRE shows a Your AI SRE Teammate page with a Join waitlist button. Joining records your interest but doesn’t turn anything on. Contact your Rootly account team to enable AI SRE.

​
Capabilities Rolled Out Separately

Some capabilities have their own enablement and may not be on for every team. Your Rootly account team turns them on:
  • Instructions, the team-wide guidance page
  • Knowledge graph and Memory
  • Generate with AI, which drafts Instructions for you
  • Rerun investigation on a finished investigation
  • The Investigations page, which lists AI SRE investigations for the selected team
  • Posting investigation results to Slack
  • Automatic investigation of new alerts and incidents without a rule
  • Automatic activation of Memory notes
  • Private agents
If a card or control described on this page is missing, it’s probably one of these.

​
Where Settings Live

AI SRE investigates through Atlas, Rootly’s AI layer. Investigations can use AI connectors, the Knowledge graph and Memory where enabled. Private Agent is an Early Preview for approved customers; those teams can also use it during investigations. Each part has its own card on the Atlas page.
The consolidated AI SRE navigation is rolling out and may not be enabled for your team yet. Until it is, open the same settings under AI & Agents, and the Investigations page from its own sidebar item. See Where AI Settings Live.
Rootly checks access on the currently selected team. Entering the AI configuration surfaces through the sidebar needs an Incident Response seat on that team, though several of them stay reachable by direct path without one. A user with View agent inventory but no seat can open Private agents directly by appending /account/private-connect/agents to the Rootly app URL, when Private Agent and AI SRE are enabled. Connecting AI connectors and managing investigation rules are open to Incident Response Owners and Admins and to On-Call Admins. Editing Instructions takes one of those roles plus an Incident Response seat. Starting an investigation needs write access to the alert or incident, and anyone who can read it can view the result. The permissions matrix has the full detail.

​
Run Your First Investigation

Work through these steps once, in order. Calibrating on an alert whose cause you already know tells you whether AI SRE reaches your team’s answer and which sources it used to get there.
1

Connect the Sources That Hold Your Evidence

AI SRE can test a cause only against evidence it can reach. Open AI SRE → Atlas → Connectors (AI & Agents → Connectors if your sidebar doesn’t have an AI SRE item) and connect two AI connectors first:
  • A code or deploy source, such as GitHub. It answers what changed before the alert fired. Without one, AI SRE doesn’t raise change-related causes and reports that it couldn’t examine them.
  • Your main observability provider, such as Datadog, Grafana, New Relic, Honeycomb, Sentry or Dash0. It supplies the metrics, logs, traces and monitors behind the alert.
If your team is approved for the Private Agent Early Preview, run a private agent for systems inside your network, such as Prometheus, Loki or Kubernetes, and manage it at AI SRE → Atlas → Private agents.Connecting requires an Incident Response Owner or Admin, or On-Call Admin, role. Other members see You do not have permission to manage this source. instead of Connect on unconnected cards.Your service catalog and supported connectors also feed the Knowledge graph, which builds in the background. Memory proposes notes from completed investigations. AI SRE uses a note only after it’s activated, either by an Incident Response Owner or Admin on the Memory page or by automatic activation where your account team has turned it on. See Memory.
When you connect Datadog, the OAuth option excludes change and deploy correlation. Choose API and application keys if AI SRE needs to see what changed before an alert.
Scope each connection to what an investigation should be able to do. Built-in connector tools can accept provider-defined commands or queries that change data, and private agent capabilities can include write operations such as HTTP POST or DELETE. Prefer read-only identities, and expose only what’s safe for unattended use. Evidence Sources covers the access boundaries.
2

Write Your Instructions

Open AI SRE → Atlas → Instructions and write down what AI SRE can’t learn from provider data: service aliases, the monitor that measures customer impact, where deploys are recorded, and the checks every investigation should make. The text applies to every alert and incident investigation for the selected team, up to 10,000 characters.Instructions guide an investigation but don’t count as evidence. Instructions covers what to include and how team-wide and rule instructions combine.If Generate with AI is available and the field is empty, it drafts instructions from your Knowledge graph facts, your investigation rules and some connected sources, and saves the draft as your live instructions. Review it as soon as it appears. Instructions lists what it reads.If the Instructions card isn’t on the AI SRE page, skip this step and put the guidance in your rule’s Instructions field in the next step.
3

Create an Investigation Rule in Manual

Pick one alert class whose cause varies, such as elevated error rates on a service that deploys often. Open AI SRE → Atlas → Investigation rules and select New rule.
  • Add conditions that describe the alert class. All conditions must match.
  • Check the Matches · 90d count beside each condition and the All conditions total. Hover a count and select View alerts to see which alerts match.
  • Optionally add rule Instructions for this alert class.
  • Leave Run mode on Manual, the default, and save.
A Manual rule never starts an investigation by itself. When someone starts one on a matching alert, the rule’s instructions apply if it’s the first matching rule that isn’t Paused. Creating rules requires an Incident Response Owner or Admin, or On-Call Admin, role. Investigation Rules covers conditions, run modes, the cooldown setting and which rule applies when several match.
If your Rootly account team has turned on automatic investigation for the selected team, new alerts are investigated automatically even when only a Manual rule matches, and those runs don’t use the Manual rule’s instructions.
4

Start an Investigation on a Known Alert

Pick a recent, resolved alert that matches your rule and whose cause your team already knows. Recent matters: AI SRE queries your providers when it runs, over a window anchored to when the alert started, so data for an old alert may be past your provider’s retention.Open the alert, select the AI SRE tab, then select Start investigation. Progress streams into the tab as AI SRE works through its stages.You need write access to the alert. Members without it see a message asking them to have a teammate with write access start the run. Starting again on an alert that already has an investigation returns that investigation, so if the tab already shows one, pick another alert. Running an Investigation lists every other way an investigation starts.
5

Read the Result Critically

Compare the finished investigation with what your team already knows:
  • The outcome. Root cause identified comes with a confidence tier, such as High confidence. Ask whether the evidence justifies it. Inconclusive — needs human means no root cause was confirmed from the evidence AI SRE could reach. Contributing factor identified and Could not investigate are covered in Reading the Result.
  • The decisive evidence. Open the Decisive items under Evidence with View and check that each source says what the report claims.
  • What was ruled out. Lines marked ruled out in the Investigation path show which explanations AI SRE rejected.
  • Where the evidence ran out. Checks marked inconclusive or no evidence, and the next step on a Blocked outcome, can point to a source to connect or re-authorize. A Suspected area names the leading explanation AI SRE couldn’t confirm.
Record your verdict with How accurate was this investigation? Reading the Result explains every part of the report, and Hypothesis Testing explains how AI SRE reaches its conclusion.
6

Promote the Rule to Auto-run

Once manual results on matching alerts look right, open the rule, set Run mode to Auto-run and save. AI SRE then investigates each new matching alert shortly after it’s created, so responders open the alert to an investigation already under way. Alerts that existed before the change aren’t investigated automatically.If the alert class fires in bursts, set Cooldown (seconds). After the rule starts an automatic investigation, it waits that long before starting another, and matching alerts in between are skipped.
An automatic investigation has no initiating user. It uses the selected team’s connector credentials and, where enabled, private agent capabilities. Before you promote a rule, confirm that everything those connections expose is safe to use unattended. An Auto-run rule with no conditions investigates every new alert, so keep conditions narrow.

​
Widen Coverage Deliberately

With one rule working, expand along whichever gap your results point to:

​
Troubleshooting

AI SRE isn’t enabled for the selected team. If you belong to more than one team, switch to the team where it should be on. Otherwise, contact your Rootly account team. The Join waitlist button doesn’t enable AI SRE, and neither does the Opt in to Rootly AI capabilities setting.
The alert tab needs only AI SRE to be enabled, while AI & Agents needs an Incident Response seat on the selected team. Ask an administrator for a seat. Admins without a seat can still manage investigation rules through the direct path in the permissions matrix. If AI & Agents shows a Request Access page, Rootly AI isn’t enabled for the team; contact your Rootly account team.
On some accounts the sidebar shows an AI SRE item that opens the Your AI SRE Teammate page even when AI SRE is enabled. Search for AI & Agents in the command menu, or open it from the settings navigation, then select AI SRE.
Scheduled maintenance incidents never show the tab. On other incidents, a missing tab means AI SRE isn’t enabled for the selected team.
Starting an investigation needs write access to the alert or incident. Ask a teammate with write access to start it. You can still view and rate the result.
These capabilities have their own enablement. Ask your Rootly account team to turn on the one you need. The Investigation rules card always appears once AI SRE is enabled.
Another matching rule may be set to Auto-run, or your Rootly account team may have turned on automatic investigation for the selected team. Either one starts a run whatever a Manual rule says. Investigation Rules explains which rule applies.

​
Frequently Asked Questions

No. Once AI SRE is enabled, you can start an investigation on any alert or non-maintenance incident from its AI SRE tab. Rules add automatic starts and alert-specific instructions, and they apply to alerts only.
A resolved alert with a known cause is the best calibration target. If Slack delivery is on for the selected team, the investigation also appears as a threaded reply under each Slack message that announced the alert, so teammates in those channels may see it. See Results in Slack. The investigation uses your connectors as configured, so scope them as described in the first step.
Start with a code or deploy source and your main observability provider. Add a source when an investigation shows it couldn’t examine something, rather than connecting everything up front.
For a public HTTPS endpoint, add a Custom MCP connector if it’s available on your Connectors page; it exposes no tools until an admin selects them. For systems inside your network, run a private agent, which connects outbound so you don’t open an inbound port.
If Rerun investigation is available on the finished investigation, select it to start a fresh run. Otherwise, starting again returns the existing investigation, so test on a new matching alert.
Atlas is Rootly’s AI layer, not a separate label in the product navigation. AI SRE is one entry point. For the investigation context, use Connectors, Private agents, Knowledge graph and Memory. The table in Where Settings Live shows where to find each one.

Rootly AI SRE

How AI SRE investigates, the outcomes it reports, and its settings.

Running an Investigation

Every way an investigation starts, by hand or automatically.

Reading the Result

Outcomes, confidence, evidence and how to give feedback.

Investigation Rules

Conditions, run modes, cooldown and rule priority.

Atlas

The context layer AI SRE investigates with.