Skip to content
ivralo

Incidents solved inside your own network.

ivralo takes the alert, finds the cause and shows the proof. On your servers, with the model you choose.

Request access

The film

The film is being made. Until it is ready, the page below walks through the same story.

It takes the alert itself.

Point Alertmanager or PagerDuty at ivralo. Each firing alert starts one investigation, and the same alert twice is never investigated twice.

ivralo serve
03:12 CheckoutErrorRate firing
investigation 3fa2c91b started
03:17 CheckoutErrorRate firing
same alert: joins 3fa2c91b

The name is the job: investigate, verify, repair, act, learn, own.

Each step leaves a record you can open, so you never have to take the model's word for it.

  1. Investigate

    Reads the logs, metrics and deploys in an evidence bundle. Every number in the report is computed from them.

    ivralo incident incident/

  2. Verify

    The cause stays labelled inferred until the code backs it. Any claim opens into the facts behind it.

    ivralo why <claim>

  3. Repairnext

    From the cause, it drafts a fix on a branch of its own, for a person to review.

    ivralo/fix-checkout-pool

  4. Actnext

    The fix arrives as a draft pull request. ivralo never merges and never deploys.

    draft pull request

  5. Learn

    Expertise lives in skills. A skill improves when the eval shows it should, through a pull request a person reviews.

    ivralo eval

  6. Own

    It runs on your servers with the model you choose. Every run, report and trace stays in your own database.

    ivralo trace last

Nothing leaves unless you allow it.

Run the model you choose: your own, on your machine or your company's endpoint, or one you buy through an API. A model outside the network is announced at every start.

Diagram: inside your network sit the server running ivralo, the model you choose, the folder you trusted, its state in PostgreSQL and your repository. A request leaving for the internet stops at the network edge, where the egress policy decides.

Every exit asks the egress policy first: the web, the browser, the shell and the worker.

Server mode

Runs next to production and takes each alert itself.

An Investigator reports with evidence, one investigation per alert. Next, a Remediator will open a draft pull request for a person to review.

Also for developers

Several coders at once, each in a worktree of its own.

You approve every edit as it is written, the way you would review a pull request, except nothing lands before you say yes.

Test it on incidents you already solved.

Bring about ten incidents with the cause your engineers found. ivralo investigates each one and is scored against that cause, on your own machine.

ivralo pilot run ~/ivralo-pilot

Expertise lives in skills, not in prompts.

A skill is a markdown file: when to use a technique, the hard rules, the code that works. Write your own, or install one from GitHub.

skills/incident-triage/SKILL.md
---name: incident-triagedescription: "Read an evidence bundle before guessing a cause."--- ## Hard rules- Every number in the report is computed from the bundle.- A cause the code does not back stays labelled inferred.- Nothing is edited during an investigation.

Installation, with you.

ivralo is set up on your own server together with your team. Send us a message and we will plan the install with you.

Message us

Run it on the machine you trust.

ivralo is not open source. Access is by invitation while it is in development, and it is set up inside your network.