Arvo-AI/aurora

Aurora — Open source AI-powered agentic incident management & root cause analysis for SREs. LangGraph agents investigate across AWS, Azure, GCP, Kubernetes. Integrates with PagerDuty, Datadog, Grafana, Slack and More. Apache 2.0.

What it solves

When an alert fires at 3 AM, an on-call engineer typically spends 30–60 minutes manually checking dashboards, running kubectl commands, reading logs, and searching Slack history. Aurora automates that entire investigation: it receives the alert, spins up AI agents that look across your whole stack, and delivers a structured root-cause analysis by the time you open your laptop. It turns a repetitive, stressful, manual process into an autonomous one.

How it works

Aurora ingests alerts from tools like PagerDuty, Datadog, Grafana, New Relic, OpsGenie, and incident.io. Each alert automatically triggers a background investigation. AI agents pick from 30+ tools to run commands—like kubectl, aws, az, and gcloud—inside sandboxed Kubernetes pods. They query logs, check deployments, correlate data across services, and build an infrastructure dependency graph to trace the blast radius. The investigation produces a structured RCA with timeline, root cause, impact, and remediation steps. Aurora can also auto-generate postmortems and even suggest code fixes with pull requests.

Who it’s for

Aurora is built for SRE teams, DevOps engineers, and anyone who does on-call rotations. It’s for teams that want to cut down alert fatigue, speed up incident response, and preserve investigation knowledge instead of leaving it siloed in individuals. Because it’s 100% self-hosted and works with an LLM API key alone, it’s also for organizations with strict data privacy requirements or air-gapped environments.

Highlights

  • Agentic investigation – AI agents autonomously choose and run 30+ tools across your infrastructure.
  • Sandboxed execution – Commands run in isolated Kubernetes pods with NetworkPolicy, not on the control plane.
  • Auto-generated postmortems – Detailed reports with timeline, root cause, impact, and remediation steps, exportable to Confluence, Notion, or SharePoint.
  • Infrastructure knowledge graph – Visualize dependencies and trace blast radius across services and providers.
  • Multi-cloud & any LLM – Works with AWS, Azure, GCP, OVH, Scaleway, Cloudflare, and supports OpenAI, Anthropic, Gemini, Vertex AI, Bedrock, OpenRouter, Ollama.
  • Self-hosted & private – No telemetry, zero data sent to Arvo AI; secrets encrypted in Vault or AWS Secrets Manager.
  • Extensible – Lifecycle hooks, command policies, MCP server, and integration with Slack, Jira, and more.

Related

  • Project
    mezmo/aura

    AURA is an open‑source SRE‑agent platform that lets you run AI‑driven incident‑investigation assistants inside your own infrastructure. It supports multiple LLM providers, configurable guardrails, OpenTelemetry tracing, and dozens of integrations (Kubernetes, Prometheus, PagerDuty, etc.). Deployable as a CLI, Docker image, Helm chart, or embedded Rust library.

  • Project
    openocta/openocta

    A desktop AIOps agent for Windows and macOS that automates IT operations tasks like alert analysis and system inspection through natural language and toolchain integration.

  • Project
    FunnyWolf/agentic-soc-platform

    An open-source security operations platform that uses Agentic AI to automate alert triage, investigation, and knowledge accumulation for security teams.

  • Project
    CloudDetail/apo

    An intelligent observability platform that uses AI agents and a specialized data plane to automate root cause analysis and diagnostic workflows for system monitoring.

  • Project
    qinshihu/itops-agent-platform

    An enterprise-grade AIOps platform that uses multi-agent AI collaboration to automate the full cycle of alert diagnosis, human-approved repair, and verification.