Investigation engine
Correlates Datadog metrics, deploys, K8s events, and GitHub diffs into ranked hypotheses and an evidence-backed root cause report.
Overview
OverviewCore capabilities
Alert intake Investigation Human approval In-cluster executePlatform
Integrations Security Why RemOps FAQ Try nowProduct overview
One closed loop from Datadog webhook to kubectl in your VPC. RemOps investigates in the cloud, you approve the plan, and RemOps Agent executes inside your network — write credentials never leave your boundary.
01 — The loop
Most ops tools stop at a chat answer. RemOps finishes the job — webhook in, root cause out, human gate, then RemOps Agent runs kubectl where your workloads already live.
01 · Intake
Datadog, Grafana Alerting, Prometheus Alertmanager, or PagerDuty posts to your org webhook. RemOps normalizes severity, service context, and labels into one incident — deduped and ready for investigation.
POST /webhook/alertINVESTIGATING automaticallyInvestigation engine queued · 47 signals pending · Datadog metrics + K8s events + deploy history
02 · Investigate
Read-only pulls across Datadog metrics, deploy diffs, K8s events, and GitHub commits. Hypotheses get scored. You get a causal chain, confidence, and a remediation plan parsed into approvable actions.
max_connections 100→10Rollback max_connections to 100, rollout restart deploy/payments-api, verify p99 < 300ms for 5 min.
03 · Approve
Remediation plans sit in AWAITING_APPROVAL. Review blast radius, dry-run results, and the exact kubectl preview. Approve or reject in one click — with full audit attribution.
Patch ConfigMap max_connections: 100 → rollout restart deploy/payments-api → verify p99 < 300ms for 5 min.
kubectl patch configmap payments-db-pool -n payments \
--type merge -p '{"data":{"max_connections":"100"}}'
kubectl rollout restart deploy/payments-api -n payments
04 · Execute
After approval, the agent polls pending work from inside your cluster. kubectl scale, patch, restart, AWS actions, GitHub workflows — executed locally, results streamed back until the incident resolves.
RESOLVED when Datadog checks pass# approved action picked up · exec-9182 $ kubectl patch configmap payments-db-pool \ -n payments --type merge -p '{"data":{"max_connections":"100"}}' ✓ configmap/payments-db-pool patched $ kubectl rollout restart deploy/payments-api -n payments ✓ deployment.apps/payments-api restarted ✓ rollout status: 3/3 ready $ kubectl scale deploy/payments-api --replicas=4 -n payments ✓ deployment.apps/payments-api scaled # verification · Datadog query p99 1.84s → 210ms · stable 5m status RESOLVED · reported to SaaS executed in-cluster · no cloud write creds used
02 — Platform
Investigation engine, 22-action catalog, integrations, and split-plane security — the same stack powers every step of the loop.
Correlates Datadog metrics, deploys, K8s events, and GitHub diffs into ranked hypotheses and an evidence-backed root cause report.
22 pre-built remediation primitives — patch, scale, restart, revert — with dry-run, blast-radius preview, and policy gates before approval.
Observability intake and read-only context from the stack you already pay for. Encrypted credentials. Least-privilege by default.
Split-plane architecture: SaaS investigates and queues work. RemOps Agent executes inside your VPC. Write credentials never leave your boundary.
Teams running production
“We used to lose forty minutes just correlating deploys with latency cliffs. RemOps gives us a root cause and an approvable plan before the secondary wakes up. Our MTTR dropped without adding headcount.”
Representative early-adopter outcome. Individual results vary by stack maturity and integration coverage.
Point your Datadog alerts. Connect your stack. The next SEV-1 takes minutes of attention — not a war room.