Operations | Monitoring | ITSM | DevOps | Cloud

TL;DR: This is the engineering companion to our announcement post, Upgraded Alert AI Analysis: Automated Incident Investigation, read that one for what the new generation does for your team; read on for how it works under the hood. Interested in hearing more? Book a demo to see the Alert AI Analysis Agent live. Root cause analysis is one of the harshest tests you can give an AI.

TL;DR: OrionIQ has launched the next generation of its Alert AI Analysis agent within the Open 360 AI platform, designed to automate and accelerate incident investigation. Key features of this evolution include: Agent-Based Investigation: Instead of relying on a single prompt, the system coordinates specialized AI agents to correlate data across diverse sources like logs, metrics, deployments, and tickets.

Last updated: July 2026 Your Rails app throws a 500. You open Sentry and find the exception. The stack trace points to a controller action, but it does not tell you why the database call failed. You switch to Datadog and search for the request trace. The trace shows a 3-second query, but you do not know what the application was logging at that moment. You open your log aggregator, paste in the request ID, and scroll through output until you find the slow query log line that explains the lock contention.

This is a follow-up to Sergiy’s post Errors, traces, logs, metrics: when to reach for what. Modern observability platforms, like Sentry, give developers a lot of choice. For a given problem, should you use traces, profiles, metrics, logs? If you take away one thing from this post, I hope it’s this: when in doubt, start by adding a few targeted log lines.

Chelsea and I recently wrote a guide on how we monitor Claude Code usage internally with Bindplane. TLDR; We remotely manage a Bindplane Distribution of the OpenTelemetry Collector (BDOT) that runs on every engineer's laptop. This setup is great, but it has one downside. Sending to Google Cloud Monitoring, Swarmia, and any other destination directly from an engineer’s laptop is limited to local processing. You can’t get the benefit of centralized routing and processing on a gateway.

How to build governance into autonomous security agents from the architecture up The industry has moved fast on capabilities. Agents now triage alerts, investigate endpoints, create detection rules, and enrich indicators, and they are even capable of performing most actions we as security operators can perform. The architecture patterns are maturing, as are the models, but governance is not keeping pace.