AI RCA for Kubernetes alerts

Find the root cause before the incident call stalls.

SREBot runs as a local agent in your Kubernetes cluster, queries Prometheus and logs, and returns an evidence-backed RCA directly in Telegram, Slack, or Discord.

Agent runs inside your cluster

Prometheus and logs queried locally

RCA delivered in team chat

incident.checkout-latency.rca
RCA ready

Alertmanager firing

Checkout latency above SLO

namespace=prod · service=checkout-api · route=/payment

P1

Latency

p95 2.8s

Errors

5xx +42%

Log match

pool timeout

Root cause

Checkout pods are waiting on PostgreSQL connections. Error rate rises only when the connection pool reaches saturation.

Recommended action

Increase pool capacity or reduce checkout worker concurrency, then verify p95 latency and DB wait events.

$ srebot evidence --incident checkout-latency
prometheus: p95 latency +318% in 10m
logs: connection acquisition timeout
scope: checkout-api pods in prod only

Built for engineering response

SREBot gathers evidence, keeps incident context, and turns alert noise into a report your team can act on.

Automated Root-Cause Analysis

Instantly investigate incidents with AI that queries Prometheus metrics and Loki logs automatically.

Multi-Channel Integration

Get diagnostic insights directly in Telegram, Slack, or Discord where your team already works.

Intelligent Observability

The AI copilot understands your infrastructure context and previous incident patterns.

Dialogue & Custom Queries

Query the bot directly by name or ask follow-up questions with a 12-hour context window right in the chat.

Custom Bot Skills

Configure user-editable guidelines, custom log parsing, and infrastructure mappings directly in the web UI.

What changes for on-call

Less tool hopping. More verified evidence.

The product is designed around the actual debugging loop: alerts, metrics, logs, hypotheses, follow-up questions, and a saved incident history.

Cuts manual searching

The agent runs the first PromQL and log checks automatically instead of making engineers start from a blank page.

Preserves incident context

Each RCA keeps the alert, tool calls, findings, and follow-up discussion in one place.

Supports follow-ups

Engineers can ask another question in chat while the bot keeps the investigation context.

Incident response diff

Replace the first 20 minutes of guesswork.

SREBot is not another dashboard. It automates the repetitive evidence-gathering loop that normally happens while the incident thread is already moving.

Manual response

manual
-open Prometheus and rebuild the query from labels
-search logs with partial service and namespace context
-paste findings into chat without a durable RCA trail
-lose context when a follow-up question arrives later

With SREBot

agentic
+parse Alertmanager labels, severity, service, and namespace
+run local read-only PromQL and log checks through the agent
+return root cause, evidence, and recommended next action
+keep the incident context for follow-up questions

From firing alert to evidence-backed RCA

The flow mirrors a real incident: detect, inspect metrics and logs, summarize the cause, then continue the investigation from chat.

01

Alert lands in chat

Alertmanager posts to Telegram, Slack, or Discord. SREBot parses labels, severity, service, namespace, and alert text.

02

Agent queries local tools

The in-cluster agent runs read-only PromQL and log searches against your observability stack without opening inbound access.

03

AI writes the RCA

The report explains the likely cause, shows evidence, and proposes the next verification or mitigation step.

04

Engineer asks follow-ups

Reply in chat to test another hypothesis while the bot keeps the incident context window.

#production-alerts
sample RCA output

FIRING · CheckoutLatencyHigh

p95 latency crossed SLO for checkout-api in prod. Severity: high.

Read-only investigation
rate(http_requests_total{status=~"5.."})done
container_cpu_usage_seconds_totaldone
logs: timeout AND checkout-apidone

Root cause analysis

Latency correlates with PostgreSQL connection wait time, not CPU saturation. Errors appear after the checkout pool reaches max open connections.

Suggested next step

Validate pool settings, reduce worker concurrency, and watch p95 latency plus DB wait events after the change.

Security & Privacy

Your data stays yours

SREBot is designed so infrastructure data never leaves your perimeter. The agent deploys inside your cluster and communicates with the Control Plane via an outbound connection only.

Self-hosted in your K8s

The agent runs inside your Kubernetes cluster and queries tools locally — no public endpoints required.

Zero Ingress

Outbound WebSocket connection only. No incoming ports, no Ingress resources for your databases and logs.

Data stays in your network

Prometheus metrics and Elasticsearch logs are queried inside your network. Only LLM prompts and responses are sent to the external service.

Open Source Agent

The full agent source code is available on GitHub. Audit it, build your own image, or fork it to suit your needs.

Read-Only Mode

The AI agent operates in read-only mode. It cannot modify infrastructure, restart pods, or alter data.

Secrets Masking

Bearer tokens, API keys, and passwords are automatically detected and redacted before being sent to the LLM.

Your Infrastructure
Prometheus
Elasticsearch / Loki
Alertmanager

Outbound Only

WebSocket over TLS

SREBot Cloud
AI analysis engine
Dashboard and RCA history
Usage and billing
SREBot Agent runs inside Kubernetes and calls your observability tools locally.
Read-only tools collect evidence without changing workloads or data.
Redaction masks tokens, keys, and passwords before LLM processing.

Need Help? Chat with Us!

Have questions about integration or setup issues? Our support team is now available directly in your SREBot dashboard via live chat.

Go to Dashboard

Simple and Transparent Pricing

Pay only for the analyses and follow-up questions your team actually runs.

Pay-as-you-go

Standard

Perfect for teams of any size

$2.00
Price per 1,000,000 Credits
  • 1 Credit = 1 Input Token
  • Output tokens cost 5 credits
  • Full incident analysis
  • Telegram, Slack & Discord integration
  • Maximum 10 bots
  • In-app live chat support
Get Started

How to estimate usage

A small team can start with occasional incident RCA and free-form questions without committing to a monthly seat plan.
A busier team can track cost per incident from real prompt and completion tokens in the dashboard.
Higher-volume teams can deploy multiple bots for different channels while keeping usage visible per organization.

Actual cost depends on alert size, tool output, follow-up questions, and the selected LLM response length.

Frequently Asked Questions

Everything you need to know about SREBot

Q1 How does SREBot investigate incidents?

SREBot deploys inside your Kubernetes cluster as a Helm chart. When Alertmanager sends an alert to your team chat (Telegram, Slack, or Discord), SREBot automatically parses the alert, deduplicates it, and runs PromQL queries against Prometheus and log searches in Elasticsearch via MCP servers. The AI agent then produces a detailed Root Cause Analysis report with recommended fixes, delivered directly in the chat as a reply to the original alert.

Q2 Is SREBot secure? Does my infrastructure data leave the cluster?

No. The SREBot agent runs entirely inside your Kubernetes cluster and queries Prometheus and Elasticsearch locally over the pod network. No Ingress resources are required. Only LLM prompts and analysis responses travel over an outbound WebSocket TLS connection to the Control Plane. Additionally, Bearer tokens, API keys, and passwords are automatically detected and redacted before any data leaves your network. The agent is open source, so you can audit every line of code.

Q3 What messaging platforms does SREBot support?

SREBot integrates with Telegram, Slack, and Discord. Each bot instance supports one platform, and you can deploy multiple bots with different tokens for different channels. The bot supports interactive follow-up questions via reply, mute/unmute commands, and alert deduplication across all platforms.

Q4 How does SREBot pricing work?

SREBot uses a pay-as-you-go token-based pricing model at $2.00 per 1 million input tokens. Output tokens cost 5 credits each. You only pay for what you use — there are no monthly subscriptions or hidden fees. Each incident analysis is billed based on the actual prompt and completion tokens consumed. Your balance can be topped up via the dashboard.

Q5 Can I ask the bot follow-up and custom questions?

Yes. You can reply directly to the analysis message or address the bot by name in the chat. SREBot supports free-form dialogue and retains context for up to 12 hours, allowing you to debug the incident further by executing PromQL queries or searching logs.

Ready to Scale Your SRE Operations?

Give your on-call team a local agent that gathers evidence before the incident thread loses momentum.

Get Started Now