> ## Documentation Index > Fetch the complete documentation index at: https://docs.rootly.com/llms.txt > Use this file to discover all available pages before exploring further. # Rootly AI SRE > Rootly AI SRE investigates alerts and incidents, tests likely causes against evidence from your connected tools, and reports the most likely root cause. Rootly AI SRE investigates alerts and incidents. It tests likely causes against live evidence from your connected tools and gives responders a result they can review: the most likely root cause when the evidence supports one, the evidence behind it, and the explanations it ruled out. When the evidence doesn't confirm a cause, the result says so instead of guessing. Your Rootly account team enables AI SRE for each Rootly team. Until then, **AI & Agents → AI SRE** shows a **Your AI SRE Teammate** page instead of its settings. See [Getting Started](/ai/ai-sre/getting-started) to check availability and prepare your first investigation. ## AI SRE and Atlas AI SRE is one entry point into [Atlas](/ai/atlas/overview), Rootly's AI layer. For investigations, it uses these sources where they are enabled. Each has its own place on the **Atlas** page: * The [Knowledge graph](/ai/atlas/knowledge-graph) maps your services, infrastructure and their relationships from your catalog and connected tools. AI SRE uses it during investigations, and **Generate with AI** can use its facts to draft instructions. Open it from the **Knowledge graph** card on the Atlas page. * [AI connectors](/ai/connectors/overview) let an investigation query your observability, code, cloud and knowledge providers. Manage them under **AI SRE → Atlas → Connectors** (**AI & Agents → Connectors** if your sidebar doesn't have an **AI SRE** item). * [Memory](/ai/atlas/memory) holds short notes about your systems that AI SRE proposes from past investigations and your team reviews. Only AI SRE reads it, and it treats a recalled note as a lead to check against live evidence, never as evidence. Open it from the **Memory** card on the Atlas page. * [Private agents](/private-agent) are an Early Preview for approved customers. They run inside your network and query systems there over an outbound-only connection. Manage them under **AI SRE → Atlas → Private agents** (**AI & Agents → Private agents** if your sidebar doesn't have an **AI SRE** item) when enabled. Other Atlas entry points include `@Rootly` in Slack, web and mobile chat, and the Chat API. They have their own available tools and permissions; the Knowledge graph and Memory described here currently support AI SRE and its settings rather than general chat. [Evidence Sources](/ai/ai-sre/evidence-sources) covers what an investigation reads and the access boundaries it works inside. ## How an Investigation Works An investigation starts when someone selects **Start investigation** on the **AI SRE** tab of an alert or incident, asks Rootly to investigate in Slack, or when an investigation rule set to **Auto-run** matches an alert as it arrives. [Running an Investigation](/ai/ai-sre/running-an-investigation) covers every way to start one. Each investigation follows an evidence-first loop: 1. **Establish context.** It reads the alert or incident, what the Knowledge graph knows about the services it names, and your instructions. 2. **Measure the signal.** It works out the symptom's shape, whether it affects one host or the whole fleet, and what changed near the time it started. 3. **Test possible causes.** It drafts competing explanations, then queries your connectors and private agents for the evidence that would confirm or rule out each one. 4. **Challenge the leading explanation.** It attacks each surviving explanation on timing, mechanism and coincidence, and looks for a better one. 5. **Write the verdict.** It writes what happened and cites the evidence behind each claim. The final outcome depends on checks Rootly runs against the recorded evidence, so the model can't declare a root cause on its own. Instructions guide this process, but they don't count as evidence. AI SRE names a root cause only when the evidence it gathered supports one. [Hypothesis Testing](/ai/ai-sre/hypothesis-testing) covers each stage. ## How an Investigation Ends A finished investigation shows one of these outcomes on the **AI SRE** tab: * **Root cause identified**: the evidence confirms a cause. The tab adds **High confidence**, **Medium confidence** or **Low confidence**. * **Contributing factor identified**: the evidence supports a factor that contributed, short of a confirmed root cause. * **Inconclusive — needs human**: no root cause was confirmed from the available evidence. The result can still name a **Suspected area**, marked **Suspected, not confirmed**. * **Blocked**: missing access or telemetry stopped the investigation, and **Recommended next steps** says what to connect or re-authorize. * **Could not investigate** or **Failed**: the run couldn't gather usable evidence, or it stopped before it finished. Some outcomes, such as **Contributing factor identified** and **Blocked**, don't appear for every team, and the **Investigations** page and Slack use shorter labels for some of them. [Reading the Result](/ai/ai-sre/reading-the-result) covers each outcome, the report and where results appear. ## Settings on the Atlas Page Beside its entry-point cards (**AI SRE**, which shows whether AI SRE is enabled, and **Conversations**), its context and tools cards (**Connectors**, **Private agents**) and **Global**, **AI SRE → Atlas** holds up to four cards for investigations. Two configure AI SRE itself. The other two are parts of Atlas that only AI SRE reads, so they sit beside them. Teams that don't have the consolidated navigation yet find the same cards under **AI & Agents → AI SRE**; see [Where AI Settings Live](/ai/ai-settings#where-ai-settings-live). | Card | What You Do There | Learn More | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | **Knowledge graph** | Explore the services, infrastructure and relationships AI SRE uses during investigations. The page is read-only, so correct data in its source systems. | [Knowledge Graph](/ai/atlas/knowledge-graph), in Atlas | | **Instructions** | Write the plain-language guidance AI SRE follows in every alert and incident investigation, up to 10,000 characters. | [Instructions](/ai/ai-sre/instructions) | | **Investigation rules** | Choose which alerts AI SRE investigates automatically, and add guidance for matching alerts. Each rule runs in **Manual**, **Auto-run** or **Paused** mode. | [Investigation Rules](/ai/ai-sre/investigation-rules) | | **Memory** | Review the notes AI SRE proposes about your systems, and activate the ones worth recalling. | [Memory](/ai/atlas/memory), in Atlas | **Investigation rules** appears whenever AI SRE is enabled for the selected team. **Knowledge graph**, **Instructions** and **Memory** may not be enabled for every team, and your Rootly account team turns them on. For who can view and change each setting, see [AI & Agents and AI SRE permissions](/managing-users/user-permissions#ai-agents-and-ai-sre). ## Explore AI SRE Confirm AI SRE is available for the selected team and prepare for your first investigation. Start an investigation from an alert, an incident or Slack, or automatically from a rule. Read the outcome, confidence and evidence, rate the result and ask follow-up questions. See how AI SRE drafts, tests and challenges explanations before it settles on an outcome. Learn what an investigation reads and the access boundaries it works inside. Match alerts by their fields, then choose manual, automatic or paused behavior. Set team-wide guidance about the systems, evidence and practices AI SRE should prioritize. ## Improve Future Investigations Tune AI SRE from completed investigations: * Add an AI connector, or adjust a connection's scope, when an investigation couldn't read a metric, log, trace, deploy or runbook it needed. * Update your instructions when every investigation should follow the same team-specific practice. * Add instructions to an investigation rule when only one alert class needs that guidance. * Keep noisy or experimental alert classes on **Manual** until the rule's match preview and completed results look reliable, then switch the rule to **Auto-run**. * Review Memory. Activate useful proposed notes, deprecate active notes that are out of date, and quarantine notes that mislead. * Rate each result under **How accurate was this investigation?**, and add a comment when it missed context or named the wrong cause. A rating doesn't change the report. ## Related Pages Rootly's AI layer behind investigations, conversations, and their available context. Connect observability, code, cloud, work tracking and knowledge providers. Query supported services inside your network through an outbound-only agent. See who can run investigations and manage AI SRE settings. Manage the team-wide Rootly AI settings and where each one lives. Review AI data access, storage, retention and permission boundaries. ## Frequently Asked Questions Yes. You can start an investigation from an alert or from any incident except a scheduled maintenance incident, which has no **AI SRE** tab. Investigation rules apply only to alerts. It can, if the tools you expose allow it, so don't treat AI SRE as read-only. Some built-in connector tools accept provider-defined commands or queries that change data when the provider account permits it. Custom MCP tools you select, and private-agent HTTP and database operations your local policy allows, can also change state. Private-agent operations run without a confirmation step, and automatic investigations start with no person involved. Use read-only provider identities where you can, and expose only tools and credentials that are safe for unattended use. [Evidence Sources](/ai/ai-sre/evidence-sources) covers the boundaries for each source. When the evidence doesn't confirm a cause, the outcome is usually **Inconclusive — needs human**, or **Blocked** when missing access stopped the run. That happens when no connected tool can read the signal, a provider refuses access, the evidence conflicts, or the evidence doesn't separate the remaining explanations. Check **Recommended next steps** and the **Investigation path** for what was tried, then connect the missing source, refine your instructions or have a responder gather the evidence. Everyone who can read the alert or incident sees the same result, including evidence gathered through connectors or private agents they couldn't query themselves. Starting an investigation requires permission to update the alert or incident. See [Reading the Result](/ai/ai-sre/reading-the-result) for how results are shared.