Skip to main content

InfraSage

InfraSage is an AI SRE platform. It ingests or federates your telemetry, detects incidents with a multi-detector ensemble, explains them with evidence-grounded root-cause analysis, and remediates them through human-approved runbooks. Every automated decision is auditable and reversible.

The operating principle throughout: the AI is the default path, never the only path. Every AI-composed view has a manual counterpart (Explore), every automated action has a human gate (Decision Queue), and every verdict shows its evidence and its confidence, including when the honest answer is "insufficient evidence."

The loop​

  Ingest / Federate ──▶ Detect ──▶ Triage ──▶ Explain ──▶ Remediate
        │                 │           │          │            │
   OTLP, Prometheus,   ensemble    incident   agentic     runbooks with
   or your existing    of 6        room +     RCA with    approval gates
   observability       detectors   decision   change      and audit
   stack (federated)               queue      evidence    trails
  1. Ingest or federate. Send OTLP, Prometheus remote-write, or JSON. Or keep raw telemetry in your existing stack and let InfraSage pull aggregates and evidence on demand (federated mode). Detection runs on one-minute aggregates either way; raw data is a short-lived transit buffer, not a data lake.
  2. Detect. Six independent detectors (robust per-metric statistics, an ML novelty model, SLO burn, cascade correlation, silence detection, and manual overrides) feed a calibrated severity model, so high means high (Alert Intelligence).
  3. Triage. Correlated alerts group into incidents with a single timeline of alerts, changes, explanations, decisions, and people (Incidents).
  4. Explain. An agentic RCA investigates with 17 evidence tools, is steered by a deterministic origin resolver, always sees what deployed recently, and abstains rather than guesses (Root Cause Analysis).
  5. Remediate. Runbooks (written in YAML, imported from your wiki, or drafted by the platform) execute through a DAG engine behind tiered human approval (Runbooks, Authoring & Import).

The console at a glance​

SurfaceWhat it's for
Mission ControlOne screen of health, impact, and what to look at next, with persona-aware layouts for SRE, EM, and executive views.
IncidentsThe incident room: grouped alerts, a composed timeline, lifecycle (open → mitigated → resolved → learned), comments, and evidence anchored to the incident's own time window.
Services & DashboardsAuto-composed per-service dashboards (golden signals, logs analysis, traces analysis, and dependencies), generated from what your service actually emits, ranked by an LLM picker, and fully customizable (Dashboards).
ExploreThe manual cockpit: chart any metric, search raw logs, walk any trace as a waterfall. No AI in the loop (Explore).
InsightsIs InfraSage working? Noise reduction, RCA accuracy, cost per RCA, and incident analytics, where every number drills to the incidents behind it.
KnowledgeLearned log patterns and the runbook catalog with drafts, review, and trust history.
ConnectTelemetry sources, federated sources, integrations, and API keys.
Engine RoomOperator view of the platform itself: queue depths, LLM circuit breakers, database pool health.

What makes it different​

Detection never depends on storing your raw telemetry. In federated mode, raw logs and traces stay in your Prometheus/Loki/Jaeger and are queried on demand, which is a real answer to a data-custody review, not a checkbox.

The AI admits what it doesn't know. The origin resolver abstains with a machine-readable reason instead of guessing, degraded (non-LLM) analyses are labeled as such and never graded as AI output, and the accuracy numbers in Insights are measured on real benchmark scenarios and say so.

"What changed?" is a guaranteed section of every analysis. Deploys, config changes, flags, and scale events land in the evidence pack automatically (Change Intelligence).

LLM cost is kept on a budget: Haiku for ranking and drafting, a larger model only where reasoning pays for itself, response caching, daily budget circuit breakers, and per-tenant rate limits. Cost per RCA is a first-class metric on the Insights page.

Every automation is gated. Runbooks are born at trust zero and tier T2 (whole-runbook approval), imported and AI-drafted runbooks cannot execute until a human promotes them, and every approve/reject/rollback is recorded with who, when, and from which surface.

Start here​