New AI triage: an alert that reasons before it pages. See examples · Docs

Five jobs that think before they page

Each one captures dashboards and numbers, judges them with rules, AI or both, and acts on the answer. Open one to see how it works.

The 3 a.m. error spike that was only a deploy Tells a traffic surge from a broken release before anyone is paged. Platform Alert
  1. CaptureErrors, traffic and the last deploy
  2. JudgeRules and AI rate the severity, 0 to 10
  3. ActSlack at 7 or more, once every 3 hours at most
What it captures
5xx count for the last hour and the hour before from Kibana Discover, all requests for the last hour, the traffic overview dashboard, and the CI page with the last deploy time. The built-in Kibana AI Triage template captures all of these except the deploy page; you add the delivery.
What the AI is asked
Rate the severity from 0 to 10. More errors with more traffic is load. More errors with flat traffic is a failure. Errors that start within ten minutes of a deploy are a bad release. Everything at zero means the source stopped.
What happens next
Below 7 the run stops and nobody is paged. At 7 and above a second AI action writes a four-sentence briefing with the numbers, and Slack gets it with the dashboard attached.

Why a plain threshold is not enough. A threshold on the error count fires on the Black Friday surge and stays quiet on a broken release with low traffic. The AI sees the traffic curve next to the error count.

Did the nightly pipeline really finish? Catches the empty table even when every DAG is green. Data Alert
  1. CaptureAirflow runs, row counts, last week
  2. JudgeLate, missing or too small for this weekday?
  3. ActData engineers know before 9:00
What it captures
The Airflow DAG runs page, a Metabase question with today’s row count per table, the Kibana hit count for ingest errors, and the same row-count question for seven days ago.
What the AI is asked
Answer 1 if the data is late, missing or implausibly small for this weekday, 0 otherwise. Mondays carry the weekend backlog and are always bigger. A table at zero rows on a day it normally has thousands is a failure, even if every DAG shows green.
What happens next
0 stops the run. 1 sends the data engineers a message with the table, the expected order of magnitude and the DAG that owns it.

Why a plain threshold is not enough. Freshness checks in SQL need one rule per table and per weekday. Here the weekday pattern is one sentence, and last week is a second capture.

Password spraying or a renumbered office? Separates an attack from people whose VPN changed. Security Alert + report
  1. CaptureFailed logins, source IPs, VPN sessions
  2. JudgeAn attack, or people?
  3. ActSecurity channel now, the CISO on Monday
What it captures
Failed logins in the last hour from the auth index, the distinct source IPs and top countries panels, the VPN sessions graph in Grafana, and the failed-login count for the hour before.
What the AI is asked
Answer 1 if this looks like an attack, 0 if it looks like people. Many accounts failing once each from many addresses is spraying. One account failing many times from one address is a forgotten password. A burst during a VPN reconnect wave is the office.
What happens next
1 goes to the security channel with the accounts and the countries panel as an image. 0 goes nowhere. Every run, verdict included, goes into a weekly report for the CISO.

Why a plain threshold is not enough. Every SIEM rule on failed logins pages on the first day of a new VPN gateway. The AI sees the VPN graph and the login graph together.

Days until the disk is full Reads the runway off the chart, not the free-space percentage. Platform Early warning
  1. CaptureDisk usage per node, 30 days
  2. JudgeDays until the first node is full
  3. ActA ticket below 21 days
What it captures
The Grafana disk usage panel of every data node over the last 30 days, the Elasticsearch index sizes page, and the current free space as a number.
What the AI is asked
Read the slope of each line and answer with the number of days until the first node reaches the flood-stage watermark. Ignore one-day steps from a snapshot restore and read the trend of the last two weeks.
What happens next
Above 21 days the run stops. Below, the platform team gets the number, the node and the panel as an image, before the cluster turns read-only.

Why a plain threshold is not enough. A threshold on free space fires at 85% with two months of runway on one node and two days on another. The runway is in the slope.

The Monday digest that writes itself Five bullets on what changed this week, above the dashboards. Leadership Report
  1. CaptureSales, traffic, backlog, and last week
  2. JudgeAI writes five bullets and one decision
  3. ActBranded PDF, Monday 7:30
What it captures
The weekly sales dashboard in Metabase, web traffic and conversion in Kibana, the support ticket backlog page, and the same three for the previous week.
What the AI is asked
Write five bullets for the leadership team on what changed this week and why it matters, with the numbers. Name the one thing that deserves a decision.
What happens next
The composer places the bullets above the dashboards in a branded PDF, and the email goes out at 7:30 on Monday. No alert, no conditions: a report with reasoning.

Why a plain threshold is not enough. Every capture of the run goes to the AI, so the digest compares this week with last week without a comparison dashboard.

An illustrative month with the first of these: 41 night pages down to 6

Plain reports and alerts work too

Capture, compose, deliver. Add a rule or the AI when a number alone cannot decide.

Security

  • Incident reports on a schedule
  • Threat alerts with evidence attached
  • Compliance snapshots for the auditor
  • Access pattern reviews

Business

  • KPI reports to the inbox
  • Sales and pipeline snapshots
  • Customer dashboards as PDF
  • Market trend alerts

Operations

  • Health checks of every service
  • Anomaly alerts across sources
  • Capacity reports
  • Uptime pages archived every run

Finance

  • Daily transaction volumes
  • Fraud pattern alerts
  • Revenue dashboards to the board
  • Budget against actuals, monthly

Who gets what

Administrators

A visual flow in a real browser, not scripts. LDAP, SAML and OIDC decide who sees what.

On-call engineers

Fewer pages, and each one names the first thing to check.

Stakeholders

This week next to last week, in a PDF, on time.

Everyone else

A history of every report, and an alert only when it is needed now.

Bring the alert that pages too often

We build the first job with you, for free.

Talk to an expert Install in a minute