keephq/keep
Keep
Keep is an open-source AIOps alert management platform that aggregates, deduplicates, and orchestrates the lifecycle of alerts from multiple monitoring tools. It functions as a multi-provider integration hub to centralize the flow of data between observability, ticketing, and communication tools.
The platform distinguishes itself through incident workflow automation and AI-powered enrichment. It uses a declarative workflow engine to execute multi-step operational sequences and integrates large language models to summarize event data and correlate technical logs for faster incident resolution.
The system provides broader capabilities for unified alert routing and bi-directional state synchronization across external platforms. It includes a containerized observability stack for telemetry and employs role-based access control and database-backed authentication to secure system entry.
The platform is deployed as a series of containerized services, including frontend, backend, and websocket layers.
Features
- Alert Managers - Functions as an alert manager that routes and groups system alerts from multiple monitoring tools based on defined rules.
- Multi-Provider Integration Hubs - Functions as a multi-provider integration hub to centralize the flow of data between observability, ticketing, and communication tools.
- Notification Deduplication - Filters redundant notifications by grouping related events into single incidents to reduce alert noise.
- Alert Correlation - Filters and groups redundant notifications while linking related events to reduce noise and identify root causes.
- Bi-Directional State Synchronizations - Maintains consistent data across ticketing and communication tools by mapping lifecycle events to remote API updates.
- Observability Tool Synchronizations - Maintains bi-directional data flow with observability and communication platforms to ensure external systems remain synchronized.
- Integration Abstraction Layers - Implements an integration abstraction layer to standardize third-party API communications from observability tools.
- Workflow Logic Engines - Uses a workflow logic engine to execute multi-step operational sequences based on predefined logic rules.
- Alert Routing - Coordinates the routing and response of system alerts to appropriate teams and communication channels.
- Alerting Systems - Consolidates alerts from multiple monitoring tools into a single interface to provide a unified view of incidents.
- Ticketing System Synchronizations - Integrates with ticketing systems to automatically create and update records based on alert lifecycle events.
- AI-Powered Enrichment - Integrates large language models to summarize event data and correlate technical logs for faster incident resolution.
- Automated Incident Response Workflows - Implements automated incident response workflows to gather technical context and execute responses when alerts fire.
- Alert Management Systems - Provides a complete alert management system that aggregates, deduplicates, and orchestrates the lifecycle of alerts.
- Automated Alerting Workflows - Defines declarative triggers and multi-step sequences to automatically process alerts and execute operational responses.
- Alert Context Enrichers - Provides capabilities to fetch additional technical details and business context from external tools to enrich active alerts.
- Notification Routing Platforms - Dispatches alert and incident updates to various communication platforms and messaging services to keep teams informed.
- LLM Contextual Integrations - Integrates large language models to summarize event data and correlate technical logs for automated analysis.
- AI-Powered Incident Analysis - Leverages large language models to summarize events and correlate data for faster technical incident resolution.
- Observability Tool Synchronization - Syncs incident states and alert data bi-directionally between monitoring platforms, ticketing systems, and communication tools.
- Observability and Monitoring - CLI tool for managing and routing infrastructure alerts.
