Skip to main content

​
Investigation workflow

OpenSRE runs a structured RCA pipeline for each alert:
  1. Extract context from the alert payload and connected integrations
  2. Plan evidence collection across logs, metrics, deploys, and dependencies
  3. Test hypotheses in a tool-calling loop until confidence is high enough to stop
  4. Publish findings as problem.md, theory/hypothesis_*.md, and report.md (or JSON with --output)
Try it:
Gotcha: The investigation uses whatever integrations are connected at run time. Run opensre integrations verify before your first production alert. See Investigations overview.

​
Integrations (60+ tools)

Connect observability, cloud, databases, incident management, messaging, and workflow systems so investigations query the same tools your engineers use. Try it:
Config: Credentials live in .env and ~/.opensre/integrations.json. See Environment variables. Gotcha: Multi-instance integrations use env vars like DD_INSTANCES or GRAFANA_INSTANCES for prod/staging pairs. See Integrations overview.

​
Interactive shell

The TTY REPL (opensre with no subcommand) supports plain-language incident descriptions, slash commands, session history, fleet monitoring, and scheduled deliveries. Try it:
Config: Set LLM_PROVIDER and the matching API key before starting. Use /effort (OpenAI/Codex) or OPENSRE_REASONING_EFFORT to tune reasoning depth. Gotcha: The action planner never denies a turn — describe compound requests in one message and it chains slash commands automatically. See Interactive Shell Commands.

​
Masking and safe sharing

Reversible masking replaces sensitive infrastructure identifiers (pods, clusters, hostnames, account IDs) with stable placeholders before external LLM calls, then restores originals in user-facing output. Try it: Enable masking in onboarding or set the masking env vars documented on Masking, then run an investigation and confirm placeholders appear in LLM-facing evidence but not in your local report.md. Gotcha: Command-history redaction is separate — see Interactive Shell Privacy.

​
Remote runtime investigations

Investigate deployed OpenSRE services by name. OpenSRE gathers live deployment status, recent logs, and health probes, then runs the standard RCA pipeline. Try it: From the REPL: /remote list, then describe the service you want to investigate. Config: Requires a configured remote runtime target. See Remote runtime investigation. Gotcha: Remote investigations use the same integration catalog as local runs — connect observability tools first.