Skip to main content
Rootly AI SRE investigates active alerts and incidents, tests likely causes against live evidence, and gives responders a reviewable diagnosis with recommended next steps.
Your Rootly account team enables AI SRE for each team. The AI & Agents → AI SRE configuration menu also requires an Incident Response seat on the currently selected team. Confirm the selected team and your seat first; if both are correct and AI SRE still doesn’t appear, contact your Rootly representative. See Manage User Permissions for the direct-path exceptions and management roles.

​
Configure AI SRE

Start with the controls that determine what AI SRE knows and when it runs.

Instructions

Add team-wide guidance about the systems, evidence, and investigation practices AI SRE should prioritize.

Investigation Rules

Match alerts by their Rootly fields or payload, then choose manual, automatic, or paused behavior.

Memory

Review the durable, evidence-backed context AI SRE can recall in future investigations.
When Knowledge graph is enabled, open AI & Agents → AI SRE → Knowledge graph to explore the services, infrastructure, environments, and relationships that AI SRE can use. The graph visualizes derived facts contributed by supported connectors; it isn’t a replica of the connectors’ raw telemetry.

​
How An Investigation Works

AI SRE follows an evidence-first investigation loop:
  1. Establish context. It reads the alert or incident, affected services, known relationships, applicable instructions, and relevant memory.
  2. Measure the signal. It checks what changed, when it changed, and how the affected window compares with normal behavior.
  3. Test possible causes. It queries the available AI connectors and Private Agent providers for the evidence each hypothesis needs.
  4. Challenge the leading explanation. It looks for contradictions and distinguishes the likely cause from symptoms and unrelated changes.
  5. Write the verdict. It presents what happened, the outcome and confidence, supporting evidence, the scope of impact, open questions, and recommended next steps when available.
Instructions guide this process, but they don’t count as evidence. AI SRE only attributes a cause when the evidence gathered during the investigation supports it.

​
Give AI SRE Access To Evidence

AI SRE combines three sources of context. Connect the smallest useful set first: the primary observability provider, the code or deployment provider, and the knowledge source that holds service runbooks. Add other providers when an investigation shows a specific evidence gap. AI connectors and Private Agent keep their own permission boundaries. Enabling AI SRE doesn’t widen a provider account, connector allowlist, Kubernetes role-based access control (RBAC), or Private Agent policy.

​
Start An Investigation Manually

Run AI SRE from an alert or a non-maintenance incident.
1

Open The Alert Or Incident

Open the affected alert or incident, then select the AI SRE tab.
2

Start The Investigation

Select Start investigation. You need write access to the alert or incident. Read-only members who can access that alert or incident can view its shared investigation result after a teammate starts the run.
3

Follow The Investigation

Watch the investigation stages and tested explanations as they update. The final report separates the conclusion, evidence, impact, and recommended next steps.
4

Rate The Result

Use the accuracy control on the completed investigation to record whether the diagnosis matched the incident. Add a comment when the result missed context, relied on weak evidence, or named the wrong cause.
AI SRE doesn’t appear on scheduled maintenance incidents because those incidents don’t represent a failure to diagnose.
The completed investigation is shared with everyone who can read the alert or incident. Rootly doesn’t re-filter the report for each later viewer based on whether that viewer could run the connector or Private Agent query themselves. Treat alert and incident readers as the audience for evidence included in the report, and scope sensitive provider credentials, Private Agent access, and source data accordingly.

​
Run Investigations Automatically

Investigation rules can start AI SRE when a new alert matches conditions such as urgency, source, title, custom fields, or payload values. Automatic rules apply to alerts; start incident investigations manually. Use automatic investigations for high-signal alert classes where responders benefit from evidence before they open the alert. Keep noisy or experimental alert classes in Manual mode until the matching preview and completed reports look reliable. An automatic investigation is a system-triggered run, so there is no initiating responder whose personal provider permissions can be used. It uses the team’s configured connector credentials and allowlisted tools. When AI SRE and Private Agent are enabled, it can also use registered Private Agent capabilities under the ai-sre system actor. Built-in connector tools can accept provider-defined commands or queries that change data, and Custom MCP or Private Agent capabilities can also be write-capable. Expose only connector capabilities, provider commands, tools, local policies, and credentials that are safe for unattended use. See Investigation Rules for the full boundary.

​
Improve Future Investigations

Tune the system from completed investigations:
  • Add or narrow an AI connector when a required metric, log, trace, deploy, or runbook wasn’t available.
  • Update AI SRE instructions when every investigation should follow the same team-specific practice.
  • Add a rule instruction when only one alert class needs that guidance.
  • Review Memory and activate useful proposed notes. Deprecate or quarantine context that is obsolete or misleading.
  • Rate the diagnosis so your team has a record of where results are strong or need more context.

AI Connectors

Connect observability, code, cloud, work tracking, and knowledge providers.

Private Agent

Query supported services inside your network through an outbound-only agent.

AI Settings

Control which Rootly AI features and surfaces the current team can use.

Data Privacy

Review AI data access, storage, retention, and permission boundaries.

​
Frequently Asked Questions

Yes. You can start an investigation from an alert or a non-maintenance incident. Investigation rules start runs only for matching alerts.
AI SRE isn’t guaranteed to be read-only. A Rootly-reviewed built-in connector tool can accept a provider-defined command or query language that changes data when provider-side controls allow it. AI SRE can also invoke a write-capable Custom MCP tool or an explicitly enabled Private Agent database or HTTP operation. Rootly doesn’t automatically classify a Custom MCP tool’s behavior. Private Agent exposes typed capabilities rather than arbitrary script execution, but locally allowlisted database and HTTP operations can still mutate state when their provider identity permits it. Provider permissions, connector allowlists, provider-side command controls, and Private Agent policy remain authoritative. Prefer read-only identities, and enable a write-capable operation only when every permitted manual or automatic use is safe.
AI SRE reports uncertainty when an available tool can’t read the required signal, the evidence conflicts, or the evidence doesn’t distinguish the remaining explanations. Connect the missing source, refine your instructions, or have a responder gather the named evidence.