> ## Documentation Index > Fetch the complete documentation index at: https://docs.rootly.com/llms.txt > Use this file to discover all available pages before exploring further. # AI SRE Investigation Rules > Match Rootly alerts by alert fields, control automatic investigations, and add alert-specific AI SRE guidance. Investigation rules decide which alerts Rootly AI SRE investigates automatically and which alert-specific instructions it applies to manual or automatic runs. Rules apply to alerts. Start an investigation on a non-maintenance incident from its **AI SRE** tab. ## Create a Rule Configure a rule and preview it against your recent alerts before saving. Paths on this page use the consolidated **AI SRE** navigation, which is rolling out. If your sidebar still shows **AI & Agents**, open rules under **AI & Agents → AI SRE → Investigation rules**. See [Where AI Settings Live](/ai/ai-settings#where-ai-settings-live). With an Incident Response seat, open **AI SRE → Atlas → Investigation rules**. An eligible admin without that seat can open the direct rules surface by appending `/account/ai/surfaces/investigation_rules` to the Rootly app URL. Select **New rule**, then enter a name that identifies the alert class, such as `Critical checkout alerts`. Select the alert fields, operators, and values the rule should match. All conditions must match. Leave the condition list empty to match every alert. Use the per-condition and combined counts to check the last 90 days. Open the matching-alert list to inspect the alerts behind a count. Optionally add guidance for this alert class, such as the service-specific signal or deploy source AI SRE should check. Select **Manual**, **Auto-run**, or **Paused**. New rules start in **Manual**. Optionally set a cooldown to limit how often this rule can start automatic investigations, then select **Save**. Incident Response Owners and Admins, and On-Call Admins, can create and manage investigation rules after your Rootly account team enables AI SRE for the current team. This rule surface does not require an Incident Response seat, but admins without that seat must use the direct path above because the broader **AI & Agents** configuration area remains seat-gated. Other members with an Incident Response seat can view the rules list but can't create, edit, delete, or preview rules. See [Manage User Permissions](/managing-users/user-permissions#ai-agents-and-ai-sre) for the canonical matrix. AI SRE is enabled separately from the **Opt in to Rootly AI capabilities** setting, so contact your Rootly account team to turn it off. You manage rules in the Rootly web app. The Rootly API doesn't expose them. ## Rule Settings A recognizable label for the alert class. Use a name that distinguishes the rule from other rules in the list. Alert fields and values that must all match. Values within one condition match any selected value. An empty condition list applies the rule to every alert. Guidance added to investigations of matching alerts, including manual runs. Rule instructions are added alongside your Global and AI SRE [instructions](/ai/ai-sre/instructions#instruction-scope-and-precedence) rather than replacing them. Instructions guide the investigation but don't count as evidence. Controls whether matching alerts run automatically, wait for a manual start, or ignore this rule. After this rule starts an automatic investigation, prevent the same rule from starting another until the cooldown expires. If the investigation fails to start, the cooldown is released. Leave it blank or enter `0` to disable the cooldown. The value must be a whole number from `0` through `2147483647`. Editing other rule settings doesn't reset a cooldown that's already running. Setting the cooldown to `0` or clearing it ends any running cooldown at once. Changing it to another positive value doesn't shorten or extend one that's already running. ## Condition Fields | Field | What It Matches | | ---------------- | ----------------------------------------------------------------------------------------------------------- | | **Title** | The alert title | | **Description** | The alert description | | **Urgency** | One or more configured alert urgencies | | **Source** | One or more alert sources that have already sent this team an alert | | **Status** | Triggered, Acknowledged, Resolved, Non-Paging (the stored `open` state), or Deferred | | **Group status** | Leader, Member, or Standalone alerts | | **Custom field** | Values from one of your alert custom fields, listed under **Fields** when your team has custom alert fields | Title, description, and custom-field conditions support these operators: * **is one of** matches when the whole value equals a selected value, without case sensitivity. * **contains one of** matches when the field contains a selected value without case sensitivity. * **is not one of** excludes the selected exact values. Urgency, source, status, and group status support **is one of** and **is not one of**. With **is not one of**, an alert with no value in the field doesn't match a title, description, urgency, source, or status condition. A custom-field condition does match an alert that has no value for that field. A rule that already has a payload condition, which matches a value at a payload path such as `details.region`, shows that path in the editor. The field picker doesn't offer payload conditions for new rows, and the 90-day counts leave them out. An alert without the payload path never matches a payload condition, even with **is not one of**. Start with stable fields such as urgency, source, and a service custom field. Use **contains one of** on the title or description when the alert text is the only reliable signal. ## Run Modes | Mode | Matching Alert Behavior | Rule Instructions | | ------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | **Manual** | AI SRE waits for a responder to select **Start investigation** | Applied to a matching manual investigation | | **Auto-run** | AI SRE starts when a new alert matches the rule | Applied to the automatic investigation and a matching manual investigation | | **Paused** | The rule neither starts an investigation nor contributes instructions. Rootly evaluates the alert as if the rule didn't exist | Not applied | Manual investigations include runs started from the alert's **AI SRE** tab, from Slack, and with **Rerun investigation** where it's available. Rootly checks **Auto-run** rules once for an alert, shortly after the alert is created, against the alert as it is at that point. Rules you create or edit later don't reach existing alerts, and later changes to an alert don't start another check. If an investigation already exists for the alert, another matching trigger doesn't start a duplicate run. A positive cooldown also suppresses automatic starts for other alerts matched by that rule until the rule's cooldown expires. Alerts that match during a cooldown are skipped rather than queued. Manual investigations remain available. ### Account-Level Automatic Investigation Your Rootly account team can also turn on automatic investigation for the selected team. It may not be enabled for your team, and there's no setting for it in **AI & Agents**. When it's on, it changes what the run modes do: * An alert that matches no **Auto-run** rule is still investigated automatically, without rule instructions. * An alert that matches only a **Manual** or **Paused** rule is still investigated automatically, without that rule's instructions. * While the matching **Auto-run** rule's cooldown is active, the alert isn't investigated automatically. It doesn't fall through to a later rule or to account-level automatic investigation. See [Running an Investigation](/ai/ai-sre/running-an-investigation#account-level-automatic-investigation) for how account-level automatic investigation also covers incidents. An automatic run has no initiating responder. It uses the Rootly AI SRE background identity, the team's configured connector credentials and any tool allowlists, and, when enabled, registered Private Agent capabilities authorized for the `ai-sre` system actor. This is **not** a read-only guarantee. Built-in connector tools can accept provider-defined commands or queries that change data when provider-side controls allow it. Atlassian, Notion, Linear, Braintrust, Honeycomb, AWS, and the Cloudflare connectors pass through the provider's full tool catalog, so the scopes and roles you grant in the provider set the boundary. Custom MCP and Private Agent can also expose write-capable operations. For **Auto-run** rules, and whenever account-level automatic investigation is on, allow only built-in connector capabilities and provider commands, Custom MCP tools, Private Agent capabilities and local policies, and provider credentials that are safe for unattended use without an interactive approval pause. ## How Overlapping Rules Behave More than one rule can match the same alert. Only one rule applies to a run, and AI SRE doesn't merge instructions from other matching rules. AI SRE handles the overlap in two parts: * **Starting the run:** the matching **Auto-run** rule created first (the oldest) controls the automatic start and its cooldown. * **Applying instructions:** for a run someone starts, the matching non-paused rule (**Manual** or **Auto-run**) created first (the oldest) contributes its rule instructions. For an automatic run, the **Auto-run** rule that started it contributes them, even when an older **Manual** rule also matches. Rootly appends each new rule to the bottom of the stored priority list. As a result, the oldest remaining rule normally has the lowest position and wins when multiple rules match. The rules table lists the newest rules first by default, which is the reverse of priority order. Editing a rule or sorting the rules table by name or run mode doesn't change its priority. You can't reorder rules. Because manual runs also consider **Manual** rules, a manual run on an alert can use a different rule's instructions than the automatic run on the same alert. Create mutually exclusive conditions when overlapping rules would give different guidance, or keep their instructions compatible. Don't use the table's current sort order to resolve an overlap. An empty-condition **Auto-run** rule matches every alert. Check the 90-day preview before saving it to avoid starting investigations for noisy or low-value alerts. ## Design Reliable Rules * Start in **Manual** mode and compare the preview with the alert class you intended to match. * Use **Auto-run** for alerts with a clear owner and enough connected evidence to investigate. * Add a cooldown when a noisy alert class can create many distinct alerts in a short period. A cooldown is shared by every alert matched by that rule. * Keep rule instructions scoped to the matched alert class. Put shared guidance in [AI SRE instructions](/ai/ai-sre/instructions). * Prefer stable normalized fields over free-form title text when both are available. * Pause a rule while changing an alert source or payload contract. * Review the **Alerts (7d)** column in the rule list for unexpected growth or inactivity. It counts investigations started under the rule in the last seven days, including manual runs and reruns, so one alert can count more than once. ## Troubleshooting Open the rule and inspect the 90-day count for each condition and for all conditions together. Add a stable discriminator such as source, urgency, or a service custom field. Values inside one condition use any-match behavior; separate conditions use all-match behavior. Confirm the rule is in **Auto-run** mode and that the alert matches every condition. Check the condition values against the matching-alert preview, whether a higher-priority matching Auto-run rule is selected, and whether that rule's cooldown is still active. An alert that already has an investigation isn't investigated again automatically. Rootly checks rules only once, shortly after the alert is created, so a rule saved after the alert arrived doesn't apply to it. AI SRE also needs to be enabled for the current team. Account-level automatic investigation is on for the selected team. **Manual** and **Paused** rules don't stop it, and those runs don't use rule instructions. Contact your Rootly account team to change it. Another non-paused rule created earlier (an older rule) may also match the alert. The rules table's sort order doesn't change priority, and you can't reorder rules. Make rules with different instructions mutually exclusive, or pause the broader rule while you refine its conditions. ## Frequently Asked Questions Yes. For a run someone starts, the matching non-paused rule created first (the oldest) contributes its instructions, whether it's in **Manual** or **Auto-run** mode. Automatic runs use the instructions of the **Auto-run** rule that started them. No. Investigation rules match alerts. Start AI SRE manually from the **AI SRE** tab on a non-maintenance incident. Incidents are investigated automatically only when your Rootly account team has turned on account-level automatic investigation. It matches every alert. Because priority follows creation order, not how specific a rule is, an empty rule overrides every newer rule it overlaps. In **Manual** mode its instructions apply to manual runs unless an older non-paused rule matches. In **Auto-run** mode it starts an investigation for every new alert and supplies its instructions to those runs unless an older **Auto-run** rule matches. Create specific rules before a catch-all rule. No. AI SRE uses the matching rule's instructions together with your Global and AI SRE instructions. Rule instructions apply even when the Instructions feature isn't enabled for the selected team. No. Create, edit, and delete rules in the Rootly web app under **AI SRE → Atlas → Investigation rules** (**AI & Agents → AI SRE → Investigation rules** if your sidebar doesn't have an **AI SRE** item). ## Related Pages How AI SRE investigates, the outcomes it reports, and its settings. Every way an investigation starts, including automatic runs. Team-wide guidance AI SRE follows in every investigation. What an investigation can read, and the access boundaries automatic runs use. Rootly's AI layer and the context available to investigations.