Product overview

Alerts become incidents.
Your cluster runs the fix.

One closed loop from Datadog webhook to kubectl in your VPC. RemOps investigates in the cloud, you approve the plan, and RemOps Agent executes inside your network — write credentials never leave your boundary.

The loop
01 Intake
02 Investigate
03 Approve
04 Execute
Platform
Investigation engine
22-action catalog
Integrations
Agent & security
Your production
Datadog Grafana PagerDuty Alertmanager Kubernetes AWS GitHub Slack

01 — The loop

Four steps. One incident.
Zero write access from the cloud.

Most ops tools stop at a chat answer. RemOps finishes the job — webhook in, root cause out, human gate, then RemOps Agent runs kubectl where your workloads already live.

01 · Intake

Alert lands. Incident created. Before you finish opening the laptop.

Datadog, Grafana Alerting, Prometheus Alertmanager, or PagerDuty posts to your org webhook. RemOps normalizes severity, service context, and labels into one incident — deduped and ready for investigation.

  • One authenticated endpoint: POST /webhook/alert
  • Payload normalizers for every major paging source
  • Incident model with severity, service, and runbook hints
  • Status moves to INVESTIGATING automatically
Explore alert intake →
webhook · org payments-prod
PD PagerDuty triggered · SEV-1
DD Datadog payments.api p99 > 400ms
GR Grafana alert: HighLatency
AM Alertmanager firing · 2m
↓ normalized · deduped
incident_id: "INC-2847" severity: "sev-1" · service: "payments-api" status: "INVESTIGATING" · sources: 2
INC-2847 · payments-api latency sev-1 namespace: payments · deduped from PagerDuty + Datadog

Next: correlate signals

Investigation engine queued · 47 signals pending · Datadog metrics + K8s events + deploy history

02 · Investigate

Root cause with receipts — not another dashboard safari.

Read-only pulls across Datadog metrics, deploy diffs, K8s events, and GitHub commits. Hypotheses get scored. You get a causal chain, confidence, and a remediation plan parsed into approvable actions.

  • 47+ signals correlated on a single timeline
  • Competing hypotheses ranked with evidence counts
  • Deploy + config diff linked to the regression window
  • Remediation plan parsed into approvable actions
Explore investigation →
investigation · INC-2847 · 2m 14s
root cause · 92% Connection pool exhaustion from config deploy
Deploy PR #4821 · max_connections 100→10
Datadog · p99 cliff 210ms → 1.84s on payments.api
K8s · connection wait spikes on payments-db-pool
GitHub · merge commit by dara@ · configmap change
Evidence trail
DD metric spike GH PR #4821 K8s pod events CM config diff PD alert context
Evidence5 sources
Hypotheses3 tested · 2 ruled out
Blast radius1 service

Recommended fix

Rollback max_connections to 100, rollout restart deploy/payments-api, verify p99 < 300ms for 5 min.

03 · Approve

Nothing writes to prod until your team signs off.

Remediation plans sit in AWAITING_APPROVAL. Review blast radius, dry-run results, and the exact kubectl preview. Approve or reject in one click — with full audit attribution.

  • Action type, target namespace, and parameters visible upfront
  • Dry-run and policy checks before the Approve button appears
  • Reject without side effects — investigation stays on record
  • Slack notifications to #incidents-ops optional
Explore human approval →
dashboard · awaiting approval
awaiting approval INC-2847 · 1 action pending · dara@ on-call

Rollback payments-db-pool config

Patch ConfigMap max_connections: 100 → rollout restart deploy/payments-api → verify p99 < 300ms for 5 min.

Dry-run passed Policies green Blast radius 1 service · payments ns
Command preview
kubectl patch configmap payments-db-pool -n payments \
  --type merge -p '{"data":{"max_connections":"100"}}'
kubectl rollout restart deploy/payments-api -n payments
Approve & execute Reject View evidence
Requested by RemOps · 03:18 UTC Approver: dara@ · on-call primary · PagerDuty escalation L1

04 · Execute

RemOps Agent runs inside your network. Write credentials never touch our SaaS.

After approval, the agent polls pending work from inside your cluster. kubectl scale, patch, restart, AWS actions, GitHub workflows — executed locally, results streamed back until the incident resolves.

  • Helm-installed agent with heartbeat and health checks
  • Polls approved actions — no inbound cluster access from cloud
  • Streams execution logs and verification metrics to dashboard
  • Status moves to RESOLVED when Datadog checks pass
Explore in-cluster execute →
remops-agent · prod-us-east-1 · heartbeat ok · v0.4.2
● executing exec-9182 · approved 03:19 UTC
# approved action picked up · exec-9182
$ kubectl patch configmap payments-db-pool \
    -n payments --type merge -p '{"data":{"max_connections":"100"}}'
 configmap/payments-db-pool patched

$ kubectl rollout restart deploy/payments-api -n payments
 deployment.apps/payments-api restarted
 rollout status: 3/3 ready

$ kubectl scale deploy/payments-api --replicas=4 -n payments
 deployment.apps/payments-api scaled

# verification · Datadog query
p99  1.84s → 210ms · stable 5m
status RESOLVED · reported to SaaS
executed in-cluster · no cloud write creds used

02 — Platform

The platform underneath.
SaaS thinks. Your cluster acts.

Investigation engine, 22-action catalog, integrations, and split-plane security — the same stack powers every step of the loop.

01

Investigation engine

Correlates Datadog metrics, deploys, K8s events, and GitHub diffs into ranked hypotheses and an evidence-backed root cause report.

hypothesis ranking · INC-2847
Config deploy regression92%
Node CPU pressure11%
RDS failoverruled out
02

Action catalog

22 pre-built remediation primitives — patch, scale, restart, revert — with dry-run, blast-radius preview, and policy gates before approval.

22 actions · payments namespace
kubectl rollout restart patch configmap scale deployment github revert aws asg refresh +17 more
03

Integrations

Observability intake and read-only context from the stack you already pay for. Encrypted credentials. Least-privilege by default.

connected · read-only
DatadogGrafanaPagerDutyAlertmanager KubernetesAWSGitHubSlack
04

Agent & security

Split-plane architecture: SaaS investigates and queues work. RemOps Agent executes inside your VPC. Write credentials never leave your boundary.

SaaS plane IntakeInvestigateApprove
Your cluster RemOps AgentExecuteVerify

Teams running production

“We used to lose forty minutes just correlating deploys with latency cliffs. RemOps gives us a root cause and an approvable plan before the secondary wakes up. Our MTTR dropped without adding headcount.”

Staff SRE Series B fintech · 40-engineer platform team
47% faster MTTR
on payment-path incidents

Representative early-adopter outcome. Individual results vary by stack maturity and integration coverage.

Keep production moving.
You stay in control.

Point your Datadog alerts. Connect your stack. The next SEV-1 takes minutes of attention — not a war room.