> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started with AI SRE

> Confirm AI SRE is enabled, connect your evidence, write Instructions, test a Manual rule on a known alert, then promote it to Auto-run.

Set up Rootly AI SRE and run a first investigation you can check against an answer your team already knows. Once the results hold up, let AI SRE investigate one alert class on its own.

<Info>
  Your Rootly account team enables AI SRE for each Rootly team. Opening **AI SRE → Atlas** (**AI & Agents → AI SRE** if your sidebar doesn't have an **AI SRE** item) also requires an Incident Response seat on the currently selected team. If the selected team and your seat are both correct and AI SRE still doesn't appear, contact your Rootly representative. See [Manage User Permissions](/managing-users/user-permissions#ai-agents-and-ai-sre) for management roles and the direct paths for admins without a seat.
</Info>

## Check That AI SRE Is Enabled

AI SRE has no self-service switch. Rootly checks it on the team you have selected, so AI SRE can be on for one team in your workspace and off for another. The **Opt in to Rootly AI capabilities** setting under **AI SRE → Atlas → Global** doesn't turn AI SRE on or off.

To check, open **AI SRE → Atlas**. The **AI SRE** card shows **Enabled** or **Off**. When AI SRE is enabled, alerts and incidents also show an **AI SRE** tab. Scheduled maintenance incidents never get the tab.

If your sidebar has no **AI SRE** item, open **AI & Agents → AI SRE** instead: either AI SRE is off for the selected team, or the consolidated navigation isn't enabled for your team yet.

When AI SRE is off, **AI & Agents → AI SRE** shows a **Your AI SRE Teammate** page with a **Join waitlist** button. Joining records your interest but doesn't turn anything on. Contact your Rootly account team to enable AI SRE.

### Capabilities Rolled Out Separately

Some capabilities have their own enablement and may not be on for every team. Your Rootly account team turns them on:

* **Instructions**, the team-wide guidance page
* **Knowledge graph** and **Memory**
* **Generate with AI**, which drafts Instructions for you
* **Rerun investigation** on a finished investigation
* The **Investigations** page, which lists AI SRE investigations for the selected team
* Posting investigation results to Slack
* Automatic investigation of new alerts and incidents without a rule
* Automatic activation of Memory notes
* **Private agents**

If a card or control described on this page is missing, it's probably one of these.

## Where Settings Live

AI SRE investigates through [Atlas](/ai/atlas/overview), Rootly's AI layer. Investigations can use AI connectors, the Knowledge graph and Memory where enabled. Private Agent is an Early Preview for approved customers; those teams can also use it during investigations. Each part has its own card on the **Atlas** page.

| What You Configure                                                                  | Where to Find It                           |
| ----------------------------------------------------------------------------------- | ------------------------------------------ |
| AI SRE settings                                                                     | **AI SRE → Atlas**                         |
| [Investigation rules](/ai/ai-sre/investigation-rules)                               | **AI SRE → Atlas → Investigation rules**   |
| [Instructions](/ai/ai-sre/instructions)                                             | **AI SRE → Atlas → Instructions**          |
| [Knowledge graph](/ai/atlas/knowledge-graph) (Atlas)                                | **AI SRE → Atlas → Knowledge graph**       |
| [Memory](/ai/atlas/memory) (Atlas)                                                  | **AI SRE → Atlas → Memory**                |
| [AI connectors](/ai/connectors/overview) (Atlas)                                    | **AI SRE → Atlas → Connectors**            |
| [Private agents](/private-agent) (Atlas)                                            | **AI SRE → Atlas → Private agents**        |
| Starting and reading an investigation                                               | The **AI SRE** tab on an alert or incident |
| The [Investigations](/ai/ai-sre/reading-the-result#the-investigations-page) history | **AI SRE → Investigations**                |

<Info>
  The consolidated **AI SRE** navigation is rolling out and may not be enabled for your team yet. Until it is, open the same settings under **AI & Agents**, and the **Investigations** page from its own sidebar item. See [Where AI Settings Live](/ai/ai-settings#where-ai-settings-live).
</Info>

Rootly checks access on the currently selected team. Entering the AI configuration surfaces through the sidebar needs an Incident Response seat on that team, though several of them stay reachable by direct path without one. A user with **View agent inventory** but no seat can open **Private agents** directly by appending `/account/private-connect/agents` to the Rootly app URL, when Private Agent and AI SRE are enabled. Connecting AI connectors and managing investigation rules are open to Incident Response Owners and Admins and to On-Call Admins. Editing Instructions takes one of those roles plus an Incident Response seat. Starting an investigation needs write access to the alert or incident, and anyone who can read it can view the result. The [permissions matrix](/managing-users/user-permissions#ai-agents-and-ai-sre) has the full detail.

## Run Your First Investigation

Work through these steps once, in order. Calibrating on an alert whose cause you already know tells you whether AI SRE reaches your team's answer and which sources it used to get there.

<Steps>
  <Step title="Connect the Sources That Hold Your Evidence">
    AI SRE can test a cause only against evidence it can reach. Open **AI SRE → Atlas → Connectors** (**AI & Agents → Connectors** if your sidebar doesn't have an **AI SRE** item) and connect two AI connectors first:

    * **A code or deploy source**, such as [GitHub](/ai/connectors/github). It answers what changed before the alert fired. Without one, AI SRE doesn't raise change-related causes and reports that it couldn't examine them.
    * **Your main observability provider**, such as Datadog, Grafana, New Relic, Honeycomb, Sentry or Dash0. It supplies the metrics, logs, traces and monitors behind the alert.

    If your team is approved for the Private Agent Early Preview, run a [private agent](/private-agent) for systems inside your network, such as Prometheus, Loki or Kubernetes, and manage it at **AI SRE → Atlas → Private agents**.

    Connecting requires an Incident Response Owner or Admin, or On-Call Admin, role. Other members see **You do not have permission to manage this source.** instead of **Connect** on unconnected cards.

    Your [service catalog](/catalogs) and [supported connectors](/ai/atlas/knowledge-graph) also feed the **Knowledge graph**, which builds in the background. Memory proposes notes from completed investigations. AI SRE uses a note only after it's activated, either by an Incident Response Owner or Admin on the Memory page or by automatic activation where your account team has turned it on. See [Memory](/ai/atlas/memory).

    <Tip>
      When you connect Datadog, the OAuth option excludes change and deploy correlation. Choose API and application keys if AI SRE needs to see what changed before an alert.
    </Tip>

    <Warning>
      Scope each connection to what an investigation should be able to do. Built-in connector tools can accept provider-defined commands or queries that change data, and private agent capabilities can include write operations such as HTTP `POST` or `DELETE`. Prefer read-only identities, and expose only what's safe for unattended use. [Evidence Sources](/ai/ai-sre/evidence-sources) covers the access boundaries.
    </Warning>
  </Step>

  <Step title="Write Your Instructions">
    Open **AI SRE → Atlas → Instructions** and write down what AI SRE can't learn from provider data: service aliases, the monitor that measures customer impact, where deploys are recorded, and the checks every investigation should make. The text applies to every alert and incident investigation for the selected team, up to 10,000 characters.

    Instructions guide an investigation but don't count as evidence. [Instructions](/ai/ai-sre/instructions) covers what to include and how team-wide and rule instructions combine.

    If **Generate with AI** is available and the field is empty, it drafts instructions from your Knowledge graph facts, your investigation rules and some connected sources, and saves the draft as your live instructions. Review it as soon as it appears. [Instructions](/ai/ai-sre/instructions#generate-with-ai) lists what it reads.

    If the **Instructions** card isn't on the AI SRE page, skip this step and put the guidance in your rule's **Instructions** field in the next step.
  </Step>

  <Step title="Create an Investigation Rule in Manual">
    Pick one alert class whose cause varies, such as elevated error rates on a service that deploys often. Open **AI SRE → Atlas → Investigation rules** and select **New rule**.

    * Add conditions that describe the alert class. All conditions must match.
    * Check the **Matches · 90d** count beside each condition and the **All conditions** total. Hover a count and select **View alerts** to see which alerts match.
    * Optionally add rule **Instructions** for this alert class.
    * Leave **Run mode** on **Manual**, the default, and save.

    A Manual rule never starts an investigation by itself. When someone starts one on a matching alert, the rule's instructions apply if it's the first matching rule that isn't **Paused**. Creating rules requires an Incident Response Owner or Admin, or On-Call Admin, role. [Investigation Rules](/ai/ai-sre/investigation-rules) covers conditions, run modes, the cooldown setting and which rule applies when several match.

    <Note>
      If your Rootly account team has turned on automatic investigation for the selected team, new alerts are investigated automatically even when only a Manual rule matches, and those runs don't use the Manual rule's instructions.
    </Note>
  </Step>

  <Step title="Start an Investigation on a Known Alert">
    Pick a recent, resolved alert that matches your rule and whose cause your team already knows. Recent matters: AI SRE queries your providers when it runs, over a window anchored to when the alert started, so data for an old alert may be past your provider's retention.

    Open the alert, select the **AI SRE** tab, then select **Start investigation**. Progress streams into the tab as AI SRE works through its stages.

    You need write access to the alert. Members without it see a message asking them to have a teammate with write access start the run. Starting again on an alert that already has an investigation returns that investigation, so if the tab already shows one, pick another alert. [Running an Investigation](/ai/ai-sre/running-an-investigation) lists every other way an investigation starts.
  </Step>

  <Step title="Read the Result Critically">
    Compare the finished investigation with what your team already knows:

    * **The outcome.** **Root cause identified** comes with a confidence tier, such as **High confidence**. Ask whether the evidence justifies it. **Inconclusive — needs human** means no root cause was confirmed from the evidence AI SRE could reach. **Contributing factor identified** and **Could not investigate** are covered in [Reading the Result](/ai/ai-sre/reading-the-result).
    * **The decisive evidence.** Open the **Decisive** items under **Evidence** with **View** and check that each source says what the report claims.
    * **What was ruled out.** Lines marked **ruled out** in the **Investigation path** show which explanations AI SRE rejected.
    * **Where the evidence ran out.** Checks marked **inconclusive** or **no evidence**, and the next step on a **Blocked** outcome, can point to a source to connect or re-authorize. A **Suspected area** names the leading explanation AI SRE couldn't confirm.

    Record your verdict with **How accurate was this investigation?** [Reading the Result](/ai/ai-sre/reading-the-result) explains every part of the report, and [Hypothesis Testing](/ai/ai-sre/hypothesis-testing) explains how AI SRE reaches its conclusion.
  </Step>

  <Step title="Promote the Rule to Auto-run">
    Once manual results on matching alerts look right, open the rule, set **Run mode** to **Auto-run** and save. AI SRE then investigates each new matching alert shortly after it's created, so responders open the alert to an investigation already under way. Alerts that existed before the change aren't investigated automatically.

    If the alert class fires in bursts, set **Cooldown (seconds)**. After the rule starts an automatic investigation, it waits that long before starting another, and matching alerts in between are skipped.

    <Warning>
      An automatic investigation has no initiating user. It uses the selected team's connector credentials and, where enabled, private agent capabilities. Before you promote a rule, confirm that everything those connections expose is safe to use unattended. An **Auto-run** rule with no conditions investigates every new alert, so keep conditions narrow.
    </Warning>
  </Step>
</Steps>

## Widen Coverage Deliberately

With one rule working, expand along whichever gap your results point to:

| If Your Results Showed                                                                     | Do This Next                                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Your team's known cause involved a feature flag, ticket or runbook that AI SRE didn't cite | Connect the matching AI connector: **LaunchDarkly**, **Atlassian** (Jira and Confluence), **Linear** or **Notion**                                                                                                                                                                        |
| A **Blocked** outcome whose next step names a connector                                    | Connect or re-authorize that connector, then test again                                                                                                                                                                                                                                   |
| The wrong service, or a missing dependency                                                 | Correct your [service catalog](/catalogs), which feeds the **Knowledge graph** that AI SRE uses to map what else could be affected. Some Service edits, such as dependencies, don't refresh the graph on their own. [Knowledge Graph](/ai/atlas/knowledge-graph) explains when it updates |
| Guidance that every investigation needs                                                    | Add it to [Instructions](/ai/ai-sre/instructions)                                                                                                                                                                                                                                         |
| Guidance that only one alert class needs                                                   | Add it to that rule's **Instructions**                                                                                                                                                                                                                                                    |
| Correct causes on your first alert class                                                   | Create a rule for the next alert class, starting in **Manual**                                                                                                                                                                                                                            |

## Troubleshooting

<AccordionGroup>
  <Accordion title="The AI SRE card shows Off, or the page shows Your AI SRE Teammate" icon="toggle-off">
    AI SRE isn't enabled for the selected team. If you belong to more than one team, switch to the team where it should be on. Otherwise, contact your Rootly account team. The **Join waitlist** button doesn't enable AI SRE, and neither does the **Opt in to Rootly AI capabilities** setting.
  </Accordion>

  <Accordion title="The AI SRE tab appears on alerts, but you can't open AI & Agents" icon="user-lock">
    The alert tab needs only AI SRE to be enabled, while **AI & Agents** needs an Incident Response seat on the selected team. Ask an administrator for a seat. Admins without a seat can still manage investigation rules through the direct path in the [permissions matrix](/managing-users/user-permissions#ai-agents-and-ai-sre). If **AI & Agents** shows a **Request Access** page, Rootly AI isn't enabled for the team; contact your Rootly account team.
  </Accordion>

  <Accordion title="The sidebar's AI SRE item always opens the waitlist page" icon="bars">
    On some accounts the sidebar shows an **AI SRE** item that opens the **Your AI SRE Teammate** page even when AI SRE is enabled. Search for **AI & Agents** in the command menu, or open it from the settings navigation, then select **AI SRE**.
  </Accordion>

  <Accordion title="An incident has no AI SRE tab" icon="calendar-xmark">
    Scheduled maintenance incidents never show the tab. On other incidents, a missing tab means AI SRE isn't enabled for the selected team.
  </Accordion>

  <Accordion title="The tab says you don't have permission to start an investigation" icon="lock">
    Starting an investigation needs write access to the alert or incident. Ask a teammate with write access to start it. You can still view and rate the result.
  </Accordion>

  <Accordion title="The Instructions, Knowledge graph or Memory card is missing" icon="eye-slash">
    These capabilities have their own enablement. Ask your Rootly account team to turn on the one you need. The **Investigation rules** card always appears once AI SRE is enabled.
  </Accordion>

  <Accordion title="Alerts are investigated automatically although the rule is Manual" icon="play">
    Another matching rule may be set to **Auto-run**, or your Rootly account team may have turned on automatic investigation for the selected team. Either one starts a run whatever a Manual rule says. [Investigation Rules](/ai/ai-sre/investigation-rules) explains which rule applies.
  </Accordion>
</AccordionGroup>

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Do I need an investigation rule to use AI SRE?" icon="sliders">
    No. Once AI SRE is enabled, you can start an investigation on any alert or non-maintenance incident from its **AI SRE** tab. Rules add automatic starts and alert-specific instructions, and they apply to alerts only.
  </Accordion>

  <Accordion title="Is it safe to calibrate on a resolved alert?" icon="shield">
    A resolved alert with a known cause is the best calibration target. If Slack delivery is on for the selected team, the investigation also appears as a threaded reply under each Slack message that announced the alert, so teammates in those channels may see it. See [Results in Slack](/ai/ai-sre/reading-the-result#results-in-slack). The investigation uses your connectors as configured, so scope them as described in the first step.
  </Accordion>

  <Accordion title="How many AI connectors do I need before results are useful?" icon="plug">
    Start with a code or deploy source and your main observability provider. Add a source when an investigation shows it couldn't examine something, rather than connecting everything up front.
  </Accordion>

  <Accordion title="What if my observability data has no built-in connector?" icon="server">
    For a public HTTPS endpoint, add a [Custom MCP connector](/ai/connectors/custom) if it's available on your Connectors page; it exposes no tools until an admin selects them. For systems inside your network, run a [private agent](/private-agent), which connects outbound so you don't open an inbound port.
  </Accordion>

  <Accordion title="How do I re-test the calibration alert after connecting more sources?" icon="rotate">
    If **Rerun investigation** is available on the finished investigation, select it to start a fresh run. Otherwise, starting again returns the existing investigation, so test on a new matching alert.
  </Accordion>

  <Accordion title="Why can't I find Atlas in the product?" icon="layer-group">
    Atlas is Rootly's AI layer, not a separate label in the product navigation. AI SRE is one entry point. For the investigation context, use **Connectors**, **Private agents**, **Knowledge graph** and **Memory**. The table in [Where Settings Live](#where-settings-live) shows where to find each one.
  </Accordion>
</AccordionGroup>

## Related Pages

<CardGroup cols={2}>
  <Card title="Rootly AI SRE" icon="robot" href="/ai/ai-sre/overview">
    How AI SRE investigates, the outcomes it reports, and its settings.
  </Card>

  <Card title="Running an Investigation" icon="play" href="/ai/ai-sre/running-an-investigation">
    Every way an investigation starts, by hand or automatically.
  </Card>

  <Card title="Reading the Result" icon="crosshairs" href="/ai/ai-sre/reading-the-result">
    Outcomes, confidence, evidence and how to give feedback.
  </Card>

  <Card title="Investigation Rules" icon="sliders" href="/ai/ai-sre/investigation-rules">
    Conditions, run modes, cooldown and rule priority.
  </Card>

  <Card title="Atlas" icon="layer-group" href="/ai/atlas/overview">
    The context layer AI SRE investigates with.
  </Card>
</CardGroup>