Rootly AI SRE

Rootly AI SRE investigates alerts and incidents, tests likely causes against evidence from your connected tools, and reports the most likely root cause.

Rootly AI SRE investigates alerts and incidents. It tests likely causes against live evidence from your connected tools and gives responders a result they can review: the most likely root cause when the evidence supports one, the evidence behind it, and the explanations it ruled out. When the evidence doesn’t confirm a cause, the result says so instead of guessing.

Your Rootly account team enables AI SRE for each Rootly team. Until then, AI & Agents → AI SRE shows a Your AI SRE Teammate page instead of its settings. See Getting Started to check availability and prepare your first investigation.

AI SRE and Atlas

AI SRE is one entry point into Atlas, Rootly’s AI layer. For investigations, it uses these sources where they are enabled. Each has its own place on the Atlas page:

• The Knowledge graph maps your services, infrastructure and their relationships from your catalog and connected tools. AI SRE uses it during investigations, and Generate with AI can use its facts to draft instructions. Open it from the Knowledge graph card on the Atlas page.
• AI connectors let an investigation query your observability, code, cloud and knowledge providers. Manage them under AI SRE → Atlas → Connectors (AI & Agents → Connectors if your sidebar doesn’t have an AI SRE item).
• Memory holds short notes about your systems that AI SRE proposes from past investigations and your team reviews. Only AI SRE reads it, and it treats a recalled note as a lead to check against live evidence, never as evidence. Open it from the Memory card on the Atlas page.
• Private agents are an Early Preview for approved customers. They run inside your network and query systems there over an outbound-only connection. Manage them under AI SRE → Atlas → Private agents (AI & Agents → Private agents if your sidebar doesn’t have an AI SRE item) when enabled.

Other Atlas entry points include @Rootly in Slack, web and mobile chat, and the Chat API. They have their own available tools and permissions; the Knowledge graph and Memory described here currently support AI SRE and its settings rather than general chat. Evidence Sources covers what an investigation reads and the access boundaries it works inside.

How an Investigation Works

An investigation starts when someone selects Start investigation on the AI SRE tab of an alert or incident, asks Rootly to investigate in Slack, or when an investigation rule set to Auto-run matches an alert as it arrives. Running an Investigation covers every way to start one.

Each investigation follows an evidence-first loop:

1. Establish context. It reads the alert or incident, what the Knowledge graph knows about the services it names, and your instructions.
2. Measure the signal. It works out the symptom’s shape, whether it affects one host or the whole fleet, and what changed near the time it started.
3. Test possible causes. It drafts competing explanations, then queries your connectors and private agents for the evidence that would confirm or rule out each one.
4. Challenge the leading explanation. It attacks each surviving explanation on timing, mechanism and coincidence, and looks for a better one.
5. Write the verdict. It writes what happened and cites the evidence behind each claim. The final outcome depends on checks Rootly runs against the recorded evidence, so the model can’t declare a root cause on its own.

Instructions guide this process, but they don’t count as evidence. AI SRE names a root cause only when the evidence it gathered supports one. Hypothesis Testing covers each stage.

How an Investigation Ends

A finished investigation shows one of these outcomes on the AI SRE tab:

• Root cause identified: the evidence confirms a cause. The tab adds High confidence, Medium confidence or Low confidence.
• Contributing factor identified: the evidence supports a factor that contributed, short of a confirmed root cause.
• Inconclusive — needs human: no root cause was confirmed from the available evidence. The result can still name a Suspected area, marked Suspected, not confirmed.
• Blocked: missing access or telemetry stopped the investigation, and Recommended next steps says what to connect or re-authorize.
• Could not investigate or Failed: the run couldn’t gather usable evidence, or it stopped before it finished.

Some outcomes, such as Contributing factor identified and Blocked, don’t appear for every team, and the Investigations page and Slack use shorter labels for some of them. Reading the Result covers each outcome, the report and where results appear.

Settings on the Atlas Page

Beside its entry-point cards (AI SRE, which shows whether AI SRE is enabled, and Conversations), its context and tools cards (Connectors, Private agents) and Global, AI SRE → Atlas holds up to four cards for investigations. Two configure AI SRE itself. The other two are parts of Atlas that only AI SRE reads, so they sit beside them. Teams that don’t have the consolidated navigation yet find the same cards under AI & Agents → AI SRE; see Where AI Settings Live.

Card	What You Do There	Learn More
Knowledge graph	Explore the services, infrastructure and relationships AI SRE uses during investigations. The page is read-only, so correct data in its source systems.	Knowledge Graph, in Atlas
Instructions	Write the plain-language guidance AI SRE follows in every alert and incident investigation, up to 10,000 characters.	Instructions
Investigation rules	Choose which alerts AI SRE investigates automatically, and add guidance for matching alerts. Each rule runs in Manual, Auto-run or Paused mode.	Investigation Rules
Memory	Review the notes AI SRE proposes about your systems, and activate the ones worth recalling.	Memory, in Atlas

Investigation rules appears whenever AI SRE is enabled for the selected team. Knowledge graph, Instructions and Memory may not be enabled for every team, and your Rootly account team turns them on. For who can view and change each setting, see AI & Agents and AI SRE permissions.

Explore AI SRE

Getting Started

Confirm AI SRE is available for the selected team and prepare for your first investigation.

Running an Investigation

Start an investigation from an alert, an incident or Slack, or automatically from a rule.

Reading the Result

Read the outcome, confidence and evidence, rate the result and ask follow-up questions.

Hypothesis Testing

See how AI SRE drafts, tests and challenges explanations before it settles on an outcome.

Evidence Sources

Learn what an investigation reads and the access boundaries it works inside.

Investigation Rules

Match alerts by their fields, then choose manual, automatic or paused behavior.

Instructions

Set team-wide guidance about the systems, evidence and practices AI SRE should prioritize.

Improve Future Investigations

Tune AI SRE from completed investigations:

• Add an AI connector, or adjust a connection’s scope, when an investigation couldn’t read a metric, log, trace, deploy or runbook it needed.
• Update your instructions when every investigation should follow the same team-specific practice.
• Add instructions to an investigation rule when only one alert class needs that guidance.
• Keep noisy or experimental alert classes on Manual until the rule’s match preview and completed results look reliable, then switch the rule to Auto-run.
• Review Memory. Activate useful proposed notes, deprecate active notes that are out of date, and quarantine notes that mislead.
• Rate each result under How accurate was this investigation?, and add a comment when it missed context or named the wrong cause. A rating doesn’t change the report.

Related Pages

Atlas

Rootly’s AI layer behind investigations, conversations, and their available context.

AI Connectors

Connect observability, code, cloud, work tracking and knowledge providers.

Private Agents

Query supported services inside your network through an outbound-only agent.

User Permissions

See who can run investigations and manage AI SRE settings.

AI Settings

Manage the team-wide Rootly AI settings and where each one lives.

Data Privacy

Review AI data access, storage, retention and permission boundaries.

Frequently Asked Questions

Can AI SRE investigate both alerts and incidents?

Yes. You can start an investigation from an alert or from any incident except a scheduled maintenance incident, which has no AI SRE tab. Investigation rules apply only to alerts.

Does AI SRE change production systems?

It can, if the tools you expose allow it, so don’t treat AI SRE as read-only. Some built-in connector tools accept provider-defined commands or queries that change data when the provider account permits it. Custom MCP tools you select, and private-agent HTTP and database operations your local policy allows, can also change state. Private-agent operations run without a confirmation step, and automatic investigations start with no person involved. Use read-only provider identities where you can, and expose only tools and credentials that are safe for unattended use. Evidence Sources covers the boundaries for each source.

Why didn't AI SRE name a root cause?

When the evidence doesn’t confirm a cause, the outcome is usually Inconclusive — needs human, or Blocked when missing access stopped the run. That happens when no connected tool can read the signal, a provider refuses access, the evidence conflicts, or the evidence doesn’t separate the remaining explanations. Check Recommended next steps and the Investigation path for what was tried, then connect the missing source, refine your instructions or have a responder gather the evidence.

Who can see an investigation's result?

Everyone who can read the alert or incident sees the same result, including evidence gathered through connectors or private agents they couldn’t query themselves. Starting an investigation requires permission to update the alert or incident. See Reading the Result for how results are shared.