DOCSEARCHbyAlgolia
Submit Docs

Keep AIOps and Alert Management Platform

repository·main·Indexed 11 days ago

https://github.com/keephq/keep

An open-source AIOps and alert management platform that centralizes monitoring alerts into a single interface, providing deduplication, enrichment, and automated workflows. Includes support for various providers such as ArgoCD, Checkmk, ClickHouse, Databend, and Flux CD, as well as ELK-stack integration for backend logs.

Tokens
184.9K
Snippets
464
Records
954
Agent score
94%

What's inside Keep

  1. Overview of Keep AIOps and Alert Management

    main

    Keep is an open-source AIOps and alert management platform designed to provide a 'single pane of glass' for incident response. It centralizes alerts and incidents through several core capabilities:

    • Alert Management: Deduplication, correlation, filtering, and enrichment of incoming alerts.
    • Unified UI: A customizable interface for viewing all alerts and incidents in one place.
    • Bi-directional Integrations: Deep, two-way synchronization with monitoring and observability tools.
    • Automation: Workflow capabilities that act like 'GitHub Actions for your monitoring tools'.
    • AI-Powered Operations (AIOps 2.0): Uses AI for automated correlation and summarization of incidents.

  2. Overview of Keep UI

    main

    Keep UI is a management platform used to configure and manage application providers. It provides a graphical interface to:

    • Connect and disconnect various providers (e.g., Grafana, Datadog).
    • Configure authentication settings for these providers.
    • Facilitate the management of provider connections through a user-friendly interface.

  4. Choose an authentication provider for Keep

    main

    Keep supports multiple authentication strategies depending on your deployment environment and security requirements.

    • No Authentication: For testing or internal use cases.
    • DB: Simple username/password authentication using the database. Best for small teams or dev/stage environments.
    • Auth0: Scalable, Auth0-based authentication.
    • Keycloak: Enterprise-grade authentication supporting SSO/SAML/OIDC, custom RBAC roles, resource-level permissions, and LDAP integration.
    • Azure AD: Enterprise SSO/SAML/OIDC via Microsoft Azure.
    • Okta: SSO/OIDC authentication.
    • OneLogin: SSO/OIDC authentication.
    • Oauth2Proxy: Supports predefined roles and SSO/OIDC.

  5. Customize Alert Management views

    main

    Keep provides a customizable interface for managing and monitoring critical alerts. You can tailor your alert management experience through the following components:

    • Alert table: The primary interface for viewing and managing active alerts.
    • Search Bar: Supports CEL (Common Expression Language) to filter alerts. You can save these specific filters as "Customized Presets" for quick access.
    • Facets: Use facets to slice and dice alert data into specific categories.
    • Columns and Time: Customize the visible columns in the alert table and adjust the time range/theme for your saved presets.

  6. Supported Integrations in Keep

    main

    Keep supports a wide range of providers categorized by their function within incident management and automation workflows. You can use these providers for AI-driven enrichments, observability, data storage, communication, incident management, ticketing, orchestration, and more.

    AI Backends

    Used for enrichments, correlations, and gathering incident context.

    • Anthropic, OpenAI, DeepSeek, Ollama, LlamaCPP, Grok, Gemini

    Observability Tools

    • AppDynamics, Axiom, Azure Monitoring, Centreon, Checkmk, Cilium, Checkly, CloudWatch, Coralogix, Dash0, Datadog, Dynatrace, Elastic, GCP Monitoring, Grafana, Grafana Loki, Graylog, Icinga2, Kibana, LibreNMS, NetBox, Netdata, New Relic, OpenSearch Serverless, Parseable, Pingdom, Prometheus, Rollbar, Sentry, SignalFX, OpenObserve, Site24x7, Splunk, StatusCake, SumoLogic, ThousandEyes, UptimeKuma, VictoriaLogs, VictoriaMetrics, Wazuh, Zabbix

    Databases & Data Warehouses

    • BigQuery, ClickHouse, Databend, MongoDB, MySQL, PostgreSQL, Snowflake

    Communication Platforms

    Used for sending alerts and notifications.

    • Discord, Google Chat, Mailgun, Mattermost, Ntfy.sh, Pushover, Resend, SendGrid, Slack, SMTP, Telegram, Twilio, Teams, Zoom, Zoom Chat

    Incident Management

    • Grafana Incident, Grafana OnCall, Ilert, Incident.io, AWS Incident Manager, OpsGenie, PagerDuty, Pagertree, SINGL4, Squadcast, Zenduty, Flashduty

    Ticketing Tools

    • Asana, GitHub, GitLab, Jira, Linear, LinearB, Microsoft Planner, Monday, Redmine, ServiceNow, Trello, YouTrack

    Container Orchestration Platforms

    • Azure AKS, ArgoCD, Flux CD, GKE, Kubernetes, OpenShift

    Data Enrichment

    Used to augment incident data via scripts or external services.

    • Bash, OpenAI, Python, QuickChart, SSH, Webhook

    Workflow Orchestration

    • Airflow

    Queues

    • Amazon SQS, Kafka

  7. Use the ilert provider for incident management

    main

    The ilert provider allows Keep to interact with ilert's API to manage the incident lifecycle and send notifications. Key capabilities include:

    • Incident Management: Create, update, and resolve incidents.
    • Event Notifications: Send custom event notifications to ilert.

    This integration connects Keep's automation capabilities with ilert's alerting, on-call management, and AI SRE platform.

  8. Manage and track incidents in Keep

    main

    Keep's incident management system allows teams to handle operational incidents from detection to resolution. The system provides a centralized view of incident metadata, including:

    • Core Details: Incident Name, Severity, Summary (with optional AI-generated summaries), and Status (e.g., open, resolved, acknowledged).
    • Timestamps: Incident Started At (first detection) and Incident Last Seen At (most recent observation).
    • Scope: Involved Services, Affected Environments, and Incident Topology (a visual map of relationships between components and infrastructure).
    • Accountability: Incident Assignee (the individual or team responsible).
    • Organization: Grouping incidents by specific attributes like service, environment, or severity.

    Users can modify incident details via the Edit Incident feature to keep information like severity or involved services up-to-date.

  9. Use the AmazonSQS Provider to consume or push alerts

    main

    The AmazonSQS Provider allows you to integrate with Amazon Simple Queue Service (SQS) for two primary workflows:

    1. Consuming SQS messages as alerts: Pulling messages from an SQS queue into Keep.
    2. Notifying/Pushing messages to SQS Queue: Sending alerts or notifications to an SQS queue.

    To use this provider, you must configure an AWS IAM user with the appropriate permissions and provide the resulting key-id pair to Keep.

  10. Provisioning options in Keep

    main

    Keep provides four distinct provisioning strategies to manage different aspects of the platform. Depending on your deployment environment and scalability needs, you can choose to provision:

    1. Provider Provisioning: Manages data providers and their associated deduplication rules.
    2. Workflow Provisioning: Configures and manages workflows.
    3. Dashboard Provisioning: Configures and manages dashboards.
    4. Mapping Rule Provisioning: Manages CSV-style alert enrichment rules using YAML manifests.

  11. What is a Provider and how is it used?

    main

    A Provider is a module that facilitates interaction between Keep and external systems. Providers serve two primary roles:

    1. As a Data Source or Destination (within Workflows)

    Providers allow Workflows to interact with the outside world:

    • Query data: Fetching data from APIs (e.g., Datadog) or running SQL queries against databases.
    • Push data: Sending notifications (e.g., Slack messages) or triggering external actions (e.g., creating a PagerDuty incident).

    2. As an Alert Source

    Providers can bring alerts into Keep. This happens in two ways:

    • Pushing alerts to Keep: The external tool sends data to Keep. For example, to push Prometheus alerts, you configure Prometheus Alertmanager to send events to https://api.keephq.dev/alerts/event/prometheus using API key authentication.
    • Pulling alerts from Keep: Keep connects to the external tool's API and automatically fetches alerts. This is easier to set up (requires only credentials) but pushing is generally preferred for automation.

  12. What is a Keep Provider and how does it work?

    main

    A Provider is a core component in Keep that enables interaction with third-party products. Providers are implemented as extensible Python code, allowing users to customize or enhance them.

    Providers serve four primary functions:

    1. Querying data: Fetching information from external sources (e.g., Datadog, Cloudwatch, Sentry).
    2. Sending notifications: Delivering alerts to communication tools (e.g., Slack, Resend, Twilio).
    3. Receiving alerts: Getting alerts from monitoring tools.
    4. Managing tools: Performing actions or managing state within third-party applications (e.g., PagerDuty, Jira).

    By using Providers, Keep acts as a single pane of glass to integrate and manage your existing toolstack.