Skip to content

Kevra FirstClue

Kevra FirstClue is an AI SRE agent. It investigates production incidents, correlates alerts, analyzes logs, and posts its findings with evidence in the channel where your team already works, Slack.

You can ask it a question in a channel, or let an alert start an investigation. It reads the ticket, pulls the relevant documentation, queries your cloud account and observability tools, and answers with its sources.

→ Sign up at app.kevra.io, subscribe to FirstClue and create a deployment. Kevra provisions your dedicated instance, and you sign in to its console with your Kevra account.

What FirstClue does

  • Investigates on request. Mention FirstClue in a Slack channel or thread. It investigates only when a user or an alert asks it to.
  • Reads your context. It searches your runbooks and documentation, reads Jira and Confluence, and checks AWS and your observability stack.
  • Answers with evidence. Each answer lists the sources it used.
  • Works with the access you give it. It can only do what the credentials you connect allow, so read-only credentials keep it read-only. On the Enterprise plan, actions that change state also wait for an explicit approval in the thread.

Integrations

FirstClue connects to Slack, GitHub, Jira, Confluence, PagerDuty, AWS, Datadog, Grafana, Prometheus, Loki, Elasticsearch and OpenSearch, CloudWatch, Splunk, Sentry, Coralogix, and more. You configure each integration in the FirstClue console, and its credentials are stored encrypted.

Model provider

FirstClue calls the model provider configured for your deployment. In the Kevra dashboard, the Model provider card of your deployment is where you pick the provider (Anthropic, OpenAI or Azure AI Foundry), paste its API key and choose the default model. Investigations can't start until a key is set. Inside the console you can then pin individual agents to another model from the same provider.

How your instance is organized

Each customer gets a dedicated FirstClue instance with its own database and its own credentials. Nothing is shared with other customers.

Within your instance, configuration follows your organization:

  • Organization: integration credentials, base prompts and default scope.
  • Teams: routing rules (which Slack channels and alert sources a team owns) and overrides.

A team inherits everything the organization sets.

Tutorials

See the tutorials for step-by-step guides.