Core · Alert intake
Every page becomes an incident with context — before you open the laptop.
One org webhook. Four shapes of alert. RemOps normalizes the firehose into incidents that already know which service, namespace, and severity just woke your rotation.
01 · Webhook
Point Datadog, Grafana, Alertmanager, or PagerDuty at one URL
Onboarding creates an org API key (beacon_live_…). You authorize POST /webhook/alert with that Bearer token — no custom middleware, no per-vendor microservices on day one.
- Alertmanager / Grafana-compatible alert groups
- Datadog monitor / event style payloads
- PagerDuty V2 and V3 incident events
- Smoke against a dedicated test org — never pollute the shared demo workspace
export API=https://api.remopsai.com export KEY=beacon_live_•••• curl -X POST "$API/webhook/alert" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{"status":"firing","alerts":[{ "labels":{"alertname":"KubePodCrashLooping", "namespace":"payments","severity":"critical"}, "annotations":{"summary":"Pod CrashLoopBackOff"} }]}' → 202 incident created · INVESTIGATING
02 · Normalize
Vendor chaos in. One incident model out.
Each source speaks a different dialect. RemOps maps titles, urgency, service hints, and label sets into a single incident record your investigation engine can reason over — so you are not rewriting parsers at 3am.
- Severity and urgency normalized across vendors
- Service / namespace / pod labels preserved for targeting
- Firing vs resolved lifecycle tracked
- Raw payload retained for audit and re-investigation
03 · Dedup & route
Stop opening twelve incidents for one outage
Related firings collapse into a working incident instead of a notification storm. On-call sees one thread with expanding evidence — not a pager that treats every scrape failure as a new SEV.
- Label-aware grouping for the same failing workload
- Status transitions when the source clears
- Ready for investigation without manual ticket hygiene
Collapsed sources
- Datadog · checkout.api.p99
- PagerDuty · checkout-api 5xx
- Alertmanager · kube deploy flap (correlated)
04 · Hand off
Intake is not the product. It is the starting gun.
The moment an incident exists, investigation begins automatically. You do not paste the alert into a chat window. RemOps already has the labels, the service hint, and the clock started.
- Automatic transition into investigation
- Dashboard shows live status from the first second
- Next step: evidence-backed root cause → Investigation
Shipping every week.
- Multi-vendor webhookSingle endpoint for Alertmanager, Grafana, Datadog, PagerDuty.
- Onboarding API keysCreate intake keys from the dashboard checklist.
- Payload retentionRaw alert body kept for audit and re-runs.
- Soft-launch pathIntake works before any cluster agent is installed.
Frequently asked questions
Sign up, create an organization, open onboarding, and create an alert intake API key. POST to https://api.remopsai.com/webhook/alert with Authorization: Bearer <key>.
No. Keep paging for humans. RemOps consumes the same events so investigation starts whether or not someone has acknowledged yet.
The normalizers accept the common shapes for each vendor. If a field is missing, RemOps still creates an incident with whatever labels are present and continues investigation with available context.
Yes — and you should. Fire smoke alerts against a dedicated org so demo workspaces stay clean.
The incident moves to INVESTIGATING. See the Investigation product page for how evidence and remediation plans are produced.
Stop pasting alerts into chat.
Create a key, point one webhook, and let the next page open as an investigation — not a blank war room.