Keep

Keep is an open-source web app and server that centralizes alert management and incident response. It acts as a single interface for monitoring tools, allowing teams to manage alerts and automate responses across a diverse tech stack. The software is deployed as a server and can be run via Docker Compose, Kubernetes, AWS ECS, or OpenShift.

Users manage the platform through a web interface and define automation using declarative YAML files. These workflows allow for the filtering of incoming alerts, the gathering of additional context, and the execution of specific actions based on the alert properties. The system supports deployment in on-premises or air-gapped environments to maintain data sovereignty and security.

Key features

• Alert deduplication, correlation, filtering, and enrichment
• Declarative YAML workflows with triggers, steps, and actions
• AI-powered correlation and summarization via multiple LLM backends
• Bi-directional synchronization with monitoring and incident tools
• Support for SSO, SAML, OIDC, and LDAP authentication
• Granular access control using RBAC and ABAC
• REST APIs and native SDKs for developer integration
• Horizontal scaling for high availability workloads

The platform integrates with a wide array of observability tools including Prometheus, Grafana, Datadog, and Zabbix. It connects to communication platforms like Slack, Discord, and Microsoft Teams, and links with ticketing systems such as Jira, GitHub, and ServiceNow. For data enrichment, it supports Python, Bash, and various AI backends including OpenAI, Anthropic, and Ollama. The workflow engine operates similarly to GitHub Actions, where a trigger starts a process, steps fetch necessary context, and actions execute operations like restarting servers or updating tickets. This architecture makes it suitable for DevOps and SRE teams requiring a centralized hub for AIOps and automated incident remediation.

Keep is a developer-first alert management platform designed for production scale and enterprise security.