Self-hosted in your K8s
The agent runs inside your Kubernetes cluster and queries tools locally — no public endpoints required.
AI RCA for Kubernetes alerts
Find the root cause before the incident call stalls.
SREBot runs as a local agent in your Kubernetes cluster, queries Prometheus and logs, and returns an evidence-backed RCA directly in Telegram, Slack, Discord, or Time.
Agent runs inside your cluster
Prometheus and logs queried locally
RCA delivered in team chat
Northstar Ops
Delivered to Telegram Slack Discord Time
production-alerts
8 members
Checkout pods are waiting on PostgreSQL connections. Error rate rises only when the connection pool reaches saturation.
Latency
p95 2.8s
Errors
5xx +42%
Log match
pool timeout
Recommended action: Increase pool capacity or reduce checkout worker concurrency, then verify p95 latency and DB wait events.
Message #production-alerts
What changes for on-call
Less tool hopping. More verified evidence.
The product is designed around the actual debugging loop: alerts, metrics, logs, hypotheses, follow-up questions, and a saved incident history.
The report explains the likely cause, shows evidence, and proposes the next verification or mitigation step.
Incident response diff
Replace the first 20 minutes of guesswork.
SREBot is not another dashboard. It automates the repetitive evidence-gathering loop that normally happens while the incident thread is already moving.
Cuts manual searching
The agent runs the first PromQL and log checks automatically instead of making engineers start from a blank page.
Preserves incident context
Each RCA keeps the alert, tool calls, findings, and follow-up discussion in one place.
Supports follow-ups
Engineers can ask another question in chat while the bot keeps the investigation context.
Live incident trace
03:18 elapsed SREBot
Read-only investigationAlert lands in chat
Alertmanager posts to Telegram, Slack, Discord, or Time. SREBot parses labels, severity, service, namespace, and alert text.
labels: service · namespace · severityAgent queries local tools
The in-cluster agent runs read-only PromQL and log searches against your observability stack without opening inbound access.
6 metric series · 128 log matchesAI writes the RCA
The report explains the likely cause, shows evidence, and proposes the next verification or mitigation step.
hypothesis confidence: highEngineer asks follow-ups
Reply in chat to test another hypothesis while the bot keeps the incident context window.
context window: 12 hours
Manual response
Manual−open Prometheus and rebuild the query from labels
−search logs with partial service and namespace context
−paste findings into chat without a durable RCA trail
With SREBot
Agentic+parse Alertmanager labels, severity, service, and namespace
+run local read-only PromQL and log checks through the agent
+return root cause, evidence, and recommended next action
Security & Privacy
Your data stays yours
SREBot is designed so infrastructure data never leaves your perimeter. The agent deploys inside your cluster and communicates with the Control Plane via an outbound connection only.
Read-Only Mode
The AI agent operates in read-only mode. It cannot modify infrastructure, restart pods, or alter data.
Secrets Masking
Bearer tokens, API keys, and passwords are automatically detected and redacted before being sent to the LLM.
Your Infrastructure
Prometheus
Elasticsearch / Loki
Alertmanager
Outbound Only
WebSocket over TLS
SREBot Cloud
AI analysis engine
Dashboard and RCA history
Usage and billing
Simple and Transparent Pricing
Pay only for the analyses and follow-up questions your team actually runs.
Pay-as-you-go
Standard
Perfect for teams of any size
$2.00 Price per 1,000,000 Credits
- 1 Credit = 1 Input Token
- Output tokens cost 5 credits
- Full incident analysis
- Telegram, Slack, Discord & Time integration
- Maximum 10 bots
- In-app live chat support
How to estimate usage
A small team can start with occasional incident RCA and free-form questions without committing to a monthly seat plan.
A busier team can track cost per incident from real prompt and completion tokens in the dashboard.
Higher-volume teams can deploy multiple bots for different channels while keeping usage visible per organization.
Actual cost depends on alert size, tool output, follow-up questions, and the selected LLM response length.
Frequently Asked Questions
Everything you need to know about SREBot
Q1 How does SREBot investigate incidents?
SREBot deploys inside your Kubernetes cluster as a Helm chart. When Alertmanager sends an alert to your team chat (Telegram, Slack, Discord, or Time), SREBot automatically parses the alert, deduplicates it, and runs PromQL queries against Prometheus and log searches in Elasticsearch via MCP servers. The AI agent then produces a detailed Root Cause Analysis report with recommended fixes, delivered directly in the chat as a reply to the original alert.
Q2 Is SREBot secure? Does my infrastructure data leave the cluster?
No. The SREBot agent runs entirely inside your Kubernetes cluster and queries Prometheus and Elasticsearch locally over the pod network. No Ingress resources are required. Only LLM prompts and analysis responses travel over an outbound WebSocket TLS connection to the Control Plane. Additionally, Bearer tokens, API keys, and passwords are automatically detected and redacted before any data leaves your network. The agent is open source, so you can audit every line of code.
Q3 What messaging platforms does SREBot support?
SREBot integrates with Telegram, Slack, Discord, and Time. Each bot instance supports one platform, and you can deploy multiple bots with different tokens for different channels. The bot supports interactive follow-up questions via reply, mute/unmute commands, and alert deduplication across all platforms.
Q4 How does SREBot pricing work?
SREBot uses a pay-as-you-go token-based pricing model at $2.00 per 1 million input tokens. Output tokens cost 5 credits each. You only pay for what you use — there are no monthly subscriptions or hidden fees. Each incident analysis is billed based on the actual prompt and completion tokens consumed. Your balance can be topped up via the dashboard.
Q5 Can I ask the bot follow-up and custom questions?
Yes. You can reply directly to the analysis message or address the bot by name in the chat. SREBot supports free-form dialogue and retains context for up to 12 hours, allowing you to debug the incident further by executing PromQL queries or searching logs.
Alert → evidence → action
Ready to Scale Your SRE Operations?
Give your on-call team a local agent that gathers evidence before the incident thread loses momentum.
Get Started Now