Skip to main content
Investigation rules decide which alerts Rootly AI SRE investigates automatically and which alert-specific instructions it applies to manual or automatic runs. Rules apply to alerts. Start an investigation on a non-maintenance incident from its AI SRE tab.

​
Create a Rule

Configure a rule and preview it against your recent alerts before saving.
Paths on this page use the consolidated AI SRE navigation, which is rolling out. If your sidebar still shows AI & Agents, open rules under AI & Agents → AI SRE → Investigation rules. See Where AI Settings Live.
1

Open Investigation Rules

With an Incident Response seat, open AI SRE → Atlas → Investigation rules. An eligible admin without that seat can open the direct rules surface by appending /account/ai/surfaces/investigation_rules to the Rootly app URL.
2

Create the Rule

Select New rule, then enter a name that identifies the alert class, such as Critical checkout alerts.
3

Add Conditions

Select the alert fields, operators, and values the rule should match. All conditions must match. Leave the condition list empty to match every alert.
4

Review Matching Alerts

Use the per-condition and combined counts to check the last 90 days. Open the matching-alert list to inspect the alerts behind a count.
5

Add Rule Instructions

Optionally add guidance for this alert class, such as the service-specific signal or deploy source AI SRE should check.
6

Choose the Run Mode

Select Manual, Auto-run, or Paused. New rules start in Manual. Optionally set a cooldown to limit how often this rule can start automatic investigations, then select Save.
Incident Response Owners and Admins, and On-Call Admins, can create and manage investigation rules after your Rootly account team enables AI SRE for the current team. This rule surface does not require an Incident Response seat, but admins without that seat must use the direct path above because the broader AI & Agents configuration area remains seat-gated. Other members with an Incident Response seat can view the rules list but can’t create, edit, delete, or preview rules. See Manage User Permissions for the canonical matrix. AI SRE is enabled separately from the Opt in to Rootly AI capabilities setting, so contact your Rootly account team to turn it off. You manage rules in the Rootly web app. The Rootly API doesn’t expose them.

​
Rule Settings

​
string
required
A recognizable label for the alert class. Use a name that distinguishes the rule from other rules in the list.
​
Alert fields and values that must all match. Values within one condition match any selected value. An empty condition list applies the rule to every alert.
​
string
Guidance added to investigations of matching alerts, including manual runs. Rule instructions are added alongside your Global and AI SRE instructions rather than replacing them. Instructions guide the investigation but don’t count as evidence.
​
required
Controls whether matching alerts run automatically, wait for a manual start, or ignore this rule.
​
integer
After this rule starts an automatic investigation, prevent the same rule from starting another until the cooldown expires. If the investigation fails to start, the cooldown is released. Leave it blank or enter 0 to disable the cooldown. The value must be a whole number from 0 through 2147483647. Editing other rule settings doesn’t reset a cooldown that’s already running. Setting the cooldown to 0 or clearing it ends any running cooldown at once. Changing it to another positive value doesn’t shorten or extend one that’s already running.

​
Condition Fields

Title, description, and custom-field conditions support these operators:
  • is one of matches when the whole value equals a selected value, without case sensitivity.
  • contains one of matches when the field contains a selected value without case sensitivity.
  • is not one of excludes the selected exact values.
Urgency, source, status, and group status support is one of and is not one of. With is not one of, an alert with no value in the field doesn’t match a title, description, urgency, source, or status condition. A custom-field condition does match an alert that has no value for that field. A rule that already has a payload condition, which matches a value at a payload path such as details.region, shows that path in the editor. The field picker doesn’t offer payload conditions for new rows, and the 90-day counts leave them out. An alert without the payload path never matches a payload condition, even with is not one of.
Start with stable fields such as urgency, source, and a service custom field. Use contains one of on the title or description when the alert text is the only reliable signal.

​
Run Modes

Manual investigations include runs started from the alert’s AI SRE tab, from Slack, and with Rerun investigation where it’s available. Rootly checks Auto-run rules once for an alert, shortly after the alert is created, against the alert as it is at that point. Rules you create or edit later don’t reach existing alerts, and later changes to an alert don’t start another check. If an investigation already exists for the alert, another matching trigger doesn’t start a duplicate run. A positive cooldown also suppresses automatic starts for other alerts matched by that rule until the rule’s cooldown expires. Alerts that match during a cooldown are skipped rather than queued. Manual investigations remain available.

​
Account-Level Automatic Investigation

Your Rootly account team can also turn on automatic investigation for the selected team. It may not be enabled for your team, and there’s no setting for it in AI & Agents. When it’s on, it changes what the run modes do:
  • An alert that matches no Auto-run rule is still investigated automatically, without rule instructions.
  • An alert that matches only a Manual or Paused rule is still investigated automatically, without that rule’s instructions.
  • While the matching Auto-run rule’s cooldown is active, the alert isn’t investigated automatically. It doesn’t fall through to a later rule or to account-level automatic investigation.
See Running an Investigation for how account-level automatic investigation also covers incidents.
An automatic run has no initiating responder. It uses the Rootly AI SRE background identity, the team’s configured connector credentials and any tool allowlists, and, when enabled, registered Private Agent capabilities authorized for the ai-sre system actor. This is not a read-only guarantee. Built-in connector tools can accept provider-defined commands or queries that change data when provider-side controls allow it. Atlassian, Notion, Linear, Braintrust, Honeycomb, AWS, and the Cloudflare connectors pass through the provider’s full tool catalog, so the scopes and roles you grant in the provider set the boundary. Custom MCP and Private Agent can also expose write-capable operations.For Auto-run rules, and whenever account-level automatic investigation is on, allow only built-in connector capabilities and provider commands, Custom MCP tools, Private Agent capabilities and local policies, and provider credentials that are safe for unattended use without an interactive approval pause.

​
How Overlapping Rules Behave

More than one rule can match the same alert. Only one rule applies to a run, and AI SRE doesn’t merge instructions from other matching rules. AI SRE handles the overlap in two parts:
  • Starting the run: the matching Auto-run rule created first (the oldest) controls the automatic start and its cooldown.
  • Applying instructions: for a run someone starts, the matching non-paused rule (Manual or Auto-run) created first (the oldest) contributes its rule instructions. For an automatic run, the Auto-run rule that started it contributes them, even when an older Manual rule also matches.
Rootly appends each new rule to the bottom of the stored priority list. As a result, the oldest remaining rule normally has the lowest position and wins when multiple rules match. The rules table lists the newest rules first by default, which is the reverse of priority order. Editing a rule or sorting the rules table by name or run mode doesn’t change its priority. You can’t reorder rules. Because manual runs also consider Manual rules, a manual run on an alert can use a different rule’s instructions than the automatic run on the same alert. Create mutually exclusive conditions when overlapping rules would give different guidance, or keep their instructions compatible. Don’t use the table’s current sort order to resolve an overlap.
An empty-condition Auto-run rule matches every alert. Check the 90-day preview before saving it to avoid starting investigations for noisy or low-value alerts.

​
Design Reliable Rules

  • Start in Manual mode and compare the preview with the alert class you intended to match.
  • Use Auto-run for alerts with a clear owner and enough connected evidence to investigate.
  • Add a cooldown when a noisy alert class can create many distinct alerts in a short period. A cooldown is shared by every alert matched by that rule.
  • Keep rule instructions scoped to the matched alert class. Put shared guidance in AI SRE instructions.
  • Prefer stable normalized fields over free-form title text when both are available.
  • Pause a rule while changing an alert source or payload contract.
  • Review the Alerts (7d) column in the rule list for unexpected growth or inactivity. It counts investigations started under the rule in the last seven days, including manual runs and reruns, so one alert can count more than once.

​
Troubleshooting

Open the rule and inspect the 90-day count for each condition and for all conditions together. Add a stable discriminator such as source, urgency, or a service custom field. Values inside one condition use any-match behavior; separate conditions use all-match behavior.
Confirm the rule is in Auto-run mode and that the alert matches every condition. Check the condition values against the matching-alert preview, whether a higher-priority matching Auto-run rule is selected, and whether that rule’s cooldown is still active. An alert that already has an investigation isn’t investigated again automatically. Rootly checks rules only once, shortly after the alert is created, so a rule saved after the alert arrived doesn’t apply to it. AI SRE also needs to be enabled for the current team.
Account-level automatic investigation is on for the selected team. Manual and Paused rules don’t stop it, and those runs don’t use rule instructions. Contact your Rootly account team to change it.
Another non-paused rule created earlier (an older rule) may also match the alert. The rules table’s sort order doesn’t change priority, and you can’t reorder rules. Make rules with different instructions mutually exclusive, or pause the broader rule while you refine its conditions.

​
Frequently Asked Questions

Yes. For a run someone starts, the matching non-paused rule created first (the oldest) contributes its instructions, whether it’s in Manual or Auto-run mode. Automatic runs use the instructions of the Auto-run rule that started them.
No. Investigation rules match alerts. Start AI SRE manually from the AI SRE tab on a non-maintenance incident. Incidents are investigated automatically only when your Rootly account team has turned on account-level automatic investigation.
It matches every alert. Because priority follows creation order, not how specific a rule is, an empty rule overrides every newer rule it overlaps. In Manual mode its instructions apply to manual runs unless an older non-paused rule matches. In Auto-run mode it starts an investigation for every new alert and supplies its instructions to those runs unless an older Auto-run rule matches. Create specific rules before a catch-all rule.
No. AI SRE uses the matching rule’s instructions together with your Global and AI SRE instructions. Rule instructions apply even when the Instructions feature isn’t enabled for the selected team.
No. Create, edit, and delete rules in the Rootly web app under AI SRE → Atlas → Investigation rules (AI & Agents → AI SRE → Investigation rules if your sidebar doesn’t have an AI SRE item).

Rootly AI SRE

How AI SRE investigates, the outcomes it reports, and its settings.

Running an Investigation

Every way an investigation starts, including automatic runs.

Instructions

Team-wide guidance AI SRE follows in every investigation.

Evidence Sources

What an investigation can read, and the access boundaries automatic runs use.

Atlas

Rootly’s AI layer and the context available to investigations.