Alert Routing and Deduplication Systems

Keep is an open-source AIOps alert management platform that aggregates, deduplicates, and orchestrates the lifecycle of alerts from multiple monitoring tools. It functions as a multi-provider integration hub to centralize the flow of data between observability, ticketing, and communication tools. The platform distinguishes itself through incident workflow automation and AI-powered enrichment. It uses a declarative workflow engine to execute multi-step operational sequences and integrates large language models to summarize event data and correlate technical logs for faster incident resolution.

Alertmanager is a monitoring notification gateway and routing service that deduplicates, groups, and directs alerts to the correct receivers. It functions as a central manager for Prometheus alerts, using a hierarchical routing tree and label-based matchers to dispatch notifications to external services. The system employs a peer-to-peer mesh network to coordinate multiple instances in a high availability cluster, ensuring continuous alert processing. It features a dedicated inhibition engine and grouping mechanisms to reduce notification noise by suppressing redundant alerts when related iss

HertzBeat is an agentless monitoring platform designed to collect performance metrics from network devices, databases, and servers without requiring client software. It functions as an infrastructure monitoring dashboard, an alert management system, and a centralized log aggregator using the OpenTelemetry Protocol. The system utilizes a cloud-edge collection hierarchy to scale data gathering across clusters and isolated networks. It distinguishes itself with a flexible extensibility model, allowing users to define new monitoring workflows through configuration-based metric templates and custo

Nightingale is a Prometheus-compatible monitoring and alerting platform designed to centralize telemetry management across multiple time-series databases. It functions as a multi-source alerting engine and metric data pipeline that ingests telemetry via remote write protocols and triggers alarms based on data from sources such as Prometheus, Elasticsearch, Loki, and ClickHouse. The system is distinguished by its automated alert healing system, which executes predefined scripts and RPC-based corrective actions when monitoring thresholds are breached. It supports distributed alert processing, a

Alerta monitoring system

TheHive is a security incident response platform and multi-tenant case management system. It functions as a Security Orchestration, Automation, and Response (SOAR) tool and a threat intelligence platform designed to coordinate security investigations by managing alerts, cases, and observables. The platform is distinguished by its multi-tenant architecture, which isolates data across different organizations while supporting selective cross-tenant sharing. It features a SOAR automation engine capable of executing sandboxed JavaScript logic to automate workflows and trigger response actions thro

Cabot is a self-hosted incident management platform and monitoring alert manager. It serves as a centralized system for receiving external monitoring data, managing on-call responder rotations, and dispatching incident notifications to administrators to ensure prompt resolution of system failures. The platform provides a containerized monitoring interface and a REST API for programmatically creating and modifying monitoring data and incident reports. It coordinates the routing of critical system alerts and manages the scheduling of personnel for on-call rotations. The system includes capabil

ntfy is a shell notification utility and multiplatform notification router designed to alert users when long-running commands finish executing. It functions as a command completion notifier that dispatches messages to desktop or mobile devices based on process duration and terminal focus. The project is an extensible notification framework that integrates third-party API push services and custom notification modules through a standard function signature. This modular architecture allows for routing alerts across various chat platforms, push services, and system-level backends. The system cov

dockprom is a monitoring stack based on Prometheus and Grafana designed to track the performance of Docker containers and their underlying hosts. It functions as a complete solution for gathering real-time metrics and displaying them through a self-hosted dashboard. The project includes a suite of tools for collecting container and host metrics, as well as a discovery tool specifically for automatically identifying and adding tagged EC2 instances to the monitoring configuration. The system covers several observability areas, including time-series data storage and the creation of performance

Noti is a set of command line utilities designed to capture process output and track execution status to trigger desktop or third-party alerts. It functions as a shell notification wrapper and pipeline utility that routes shell output and execution status to desktop banners or messaging services. The project provides a process monitoring utility capable of tracking specific process identifiers to send notifications immediately upon program termination. It also includes a CLI output notifier that captures standard input and forwards the text as a notification message. The system covers comman

Notifire is a multi-channel notification infrastructure designed to route and dispatch alerts across email, SMS, push, and chat providers through a unified interface. It functions as an agent communication gateway that normalizes inbound and outbound messages between chat platforms and AI agents for consistent data processing. The system includes a notification workflow engine that uses branching conditions and batching capabilities to design delivery sequences and reduce user fatigue. It also provides a pre-built notification center component, allowing web applications to embed a real-time i

Nezha is a multi-server infrastructure monitor and website uptime monitor that provides a centralized dashboard for tracking real-time resource utilization and system health. It functions as a protocol server and alerting engine, utilizing remote agents to collect telemetry data across multiple operating systems. The system distinguishes itself with a web-based remote administration interface, allowing users to execute maintenance commands and manage scheduled tasks on remote hosts via a browser-based terminal. It also integrates a Model Context Protocol server to provide a secure HTTP entry