Avesha vs Hyground (2026)

Obliq's Auto-Remediator executes rollbacks, replica bursts and configuration hot patches on the customer's Kubernetes, and its agents read metrics, traces, logs and CI and pull request activity. RBAC integrates with existing identity providers.

Sourceavesha.io/obliqread 2026-09-29

Read only adapters reach Kubernetes, AWS, Azure and Google Cloud, Argo CD and Flux, Loki, OpenSearch, Elasticsearch, Graylog and Splunk logs, Prometheus, InfluxDB and Nagios metrics, Jaeger traces, PostgreSQL, MySQL, Oracle, MongoDB, Redis and ClickHouse, RabbitMQ and Kafka, and documentation in Confluence, Git and Artifactory, plus the customer's own HTTP APIs and in cluster MCP servers.

Scoped writes reach Jira, ServiceNow, PagerDuty, ilert, GitHub, GitLab, Slack, Teams and email, so findings come back as tickets, comments, pull requests and answered threads. Adapters run in the customer's cluster and refuse to start if their principal can write.

Sourcehyground.ai/product/integrations and hyground.ai/product/architectureread 2026-10-25

Three agents hand work along a chain, a Code-Drift Analyzer, a Root-Cause Synthesizer and an Auto-Remediator, and declarative playbooks trigger validated rollbacks or auto-patches under custom SLAs and policies.

Sourceavesha.io/obliqread 2026-09-29

A multi agent system plans each investigation, sends specialised agents to work logs, metrics and knowledge in parallel, and aggregates what they find into one answer, with a card per sub agent in the Tools panel. Investigations fan out across every cluster or cluster group the customer runs. Teams turn procedures into skills that run the same steps every time, on demand, from a schedule or loaded by the agent when a skill's When to use line matches, and the customer defines those steps.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/glossary and run-a-skillread 2026-10-25

Obliq watches CI, pull requests and GenAI commits to flag untested diffs before rollout, and acts on telemetry anomalies and policy violations in real time, detecting and self healing before humans are paged.

Sourceavesha.io/obliqread 2026-09-29

Herald, Hyground's notification gateway, takes any JSON posted to one endpoint, from Alertmanager, Grafana, Datadog, PagerDuty, GitHub, Jira, ServiceNow, cron or curl, checks it for prompt injection and opens an Auto RCA when it describes an incident. People also start sessions from Slack, Microsoft Teams or email, schedules run saved tasks from every five minutes to monthly, and a watch repeats a check inside one session at an interval for up to 24 hours.

Sourcehyground.ai/product/triggers, docs.hyground.ai/user-guide/sessions-hyground-starts and schedule-a-sessionread 2026-10-25

Root cause work correlates live metrics, traces, logs, slice health and model telemetry into a causal narrative per incident. There is no maintained index over runbooks or knowledge bases.

Sourceavesha.io/obliqread 2026-09-29

A knowledge base holds the customer's runbooks, documentation and past investigations, embedded for retrieval inside the customer's cluster. Administrators import what goes in, wiki pages, documentation files from Git repositories, files from Artifactory and uploaded documents, and the content is as current as the last import. The agent searches it on its own while it writes a reply, alongside live cluster state, and each search shows in the Tools panel with the words searched and the matching passages, each naming the document it came from.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/how-the-agent-uses-knowledgeread 2026-10-25

Telemetry is stitched with memory of prompt, tool and outcome, and Obliq learns from prior decisions to improve outcomes, but Avesha gives that memory no stated scope, lifetime or customer control.

Sourceavesha.io/obliqread 2026-09-29

Inside a session the agent works from its full history, condensed into a summary when a session runs long. Across sessions, recall brings content from the user's own past sessions and every shared session into a new one when the user points the agent at earlier work, and never reads another user's private session. The knowledge base also holds past investigations embedded for retrieval, and the agent's writes include its own knowledge base. No memory the agent keeps for itself with a stated lifetime and a place to review or edit it is described.

Sourcedocs.hyground.ai/user-guide/what-the-agent-remembers, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Customer controlled constraints govern what the agent may do. Obliq calculates risk scores, enforces custom SLAs and policies through policy as code, and applies time bound access controls. There is no step where a person approves an action before it runs.

Sourceavesha.io/obliqread 2026-09-29

The agent is read only by default, and adapters enforce that below the model. Administrators allow selected write actions and decide which need confirmation; for those the agent shows an Action Confirmation Required card with the operation and the full command, which only the session owner can approve or deny, and the offer expires after 15 minutes by default. A mail or chat message is shown before it goes out unless the user asked for the send outright. Sessions from schedules and Auto RCAs have no owner, so no one can approve a write in them. Hyground does not claim remediation today.

Sourcedocs.hyground.ai/user-guide/whose-access-the-agent-uses and hyground.ai/use-cases/nis2-doraread 2026-10-25

Access runs on policy as code and RBAC integration with existing identity providers, with time bound access controls. There is no published certification or trust center.

Sourceavesha.io/obliqread 2026-09-29

Hyground is ISO/IEC 27001:2022 certified and publishes a CycloneDX software bill of materials with every release. Sessions, queries and actions tie to a named user through OIDC single sign on (Entra ID, Zitadel or any OIDC provider), automation runs under scoped technical users with the same audit trail, and administrators assign roles that decide which connected systems and features each user may use. Tool responses pass a secret filter before the model sees them, and images are Chainguard distroless, non root and read only.

Sourcehyground.ai/product/security, hyground.ai/use-cases/nis2-dora and docs.hyground.ai/user-guide/personalize-hygroundread 2026-10-25

Each incident gets a causal narrative, and Obliq offers audit hooks for internal compliance, but Avesha does not describe a per run record of the steps the agents took or the actions the Auto-Remediator executed.

Sourceavesha.io/obliqread 2026-09-29

A Tools panel on each reply lists every tool call and knowledge search, Show command reveals exactly what the agent ran and Show response what each system returned, and the reasoning view shows the agent's thinking as it works. Every investigation, query and finding produces a structured, exportable record that compliance teams can audit, every step is recorded and replayable, sessions export with their files, and a post mortem draft is written from the investigation.

Sourcedocs.hyground.ai/user-guide/how-the-agent-answers, hyground.ai/product/security and hyground.ai/product/architectureread 2026-10-25

Obliq needs a Kubernetes cluster, Helm 3.8 or later and cluster admin access, and it deploys as a single Helm chart into the customer's own cluster, with integration pages for AWS, Google Cloud and Oracle Kubernetes Engine.

SourceAvesha Obliq 1.5.0 prerequisites and repo.obliq.avesha.io; docs.avesha.io/documentation/enterprise-obliq/1.5.0/prerequisitesread 2026-09-30

Hyground installs from one Helm chart into the customer's own Kubernetes cluster (AKS, EKS, GKE, OpenShift, K3s or on premises) and stays there, the agents, knowledge base, audit trail and model connection included, with everything stored in the customer's own PostgreSQL. There is no SaaS control plane, phone home or vendor access path, the license validates offline, images mirror into air gapped registries, and each connected environment runs a small outpost gateway. The only outbound traffic is the prompt to the model the customer chose, and with a self hosted model nothing leaves.

Sourcehyground.ai/product/security, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Named prebuilt agents each have their own job. The Code-Drift Analyzer flags untested diffs from CI and pull requests on its own, beside the Root-Cause Synthesizer and the Auto-Remediator, with declarative playbooks.

Sourceavesha.io/obliqread 2026-09-29

System skills ship with Hyground, always active and read only, and a Skill blueprints page offers ready made use cases, filtered by tags and marked when the skill needs write access. Choosing one has the agent explore the environment, check the blueprint's assumptions against it, gather the setup details it needs from the user, write the skill with them and offer a test run. Named jobs include incident investigation, cost analysis, CVE blast radius, RBAC drift, cluster right sizing and NIS2 and DORA reporting. Teams also write and share their own skills, versioned and grouped by category.

Sourcedocs.hyground.ai/user-guide/create-a-skill, run-a-skill and hyground.airead 2026-10-25

The Obliq 1.5.0 integrations let the customer configure OpenAI with its own API key and choose a model from a dropdown, configure Google Gemini the same way, or point the agent at any endpoint following the OpenAI chat completions format with its own key and a custom model ID. So the customer chooses across model makers and can bring its own model.

Sourcedocs.avesha.io/documentation/enterprise-obliq/1.5.0/integrations/openai-compatibleread 2026-09-30

Agents reach their model through LiteLLM, with a primary and a fallback, so the customer picks Azure OpenAI, OpenAI, Anthropic, Google Gemini on Vertex AI or AI Studio, AWS Bedrock, Azure AI Foundry, OpenAI compatible endpoints such as vLLM, Scaleway, Together or Fireworks, or a self hosted model through Ollama, and swaps providers without touching the rest of the system. Model costs are paid to the provider under the customer's own contract.

Sourcehyground.ai/product/architecture, hyground.ai/product/integrations and hyground.ai/use-cases/nis2-doraread 2026-10-25

Obliq is called MCP-Ready, but no endpoint, auth scheme or tool list is published, and there is no API or SDK for Obliq. The MCP services connect outward to the customer's AWS, Prometheus, Loki and CloudWatch and do not give outside callers a way in.

Sourceavesha.io/obliqread 2026-09-29

Herald's single webhook endpoint (/api/herald/webhook) lets any outside system that can POST JSON start an investigation, and the architecture page lists Claude Code, Cursor and any MCP client among the signals that reach Hyground. There is no API reference, SDK or Hyground MCP server documented with an endpoint and authentication, and the customer MCP servers and HTTP APIs it connects to are integrations the agent calls.

Sourcehyground.ai/product/triggers and hyground.ai/product/architectureread 2026-10-25

Avesha describes a learning loop in one sentence, in which incidents feed reinforcement learning loops and the system upgrades itself. Flagging untested diffs tests the customer's code, not the agent, and there is no evaluation harness.

Sourceavesha.io/obliqread 2026-09-29

Users rate replies up or down, with reasons such as inaccurate, missing context or made up, and guidance shows how to check each claim against a tool result. A skill written from a blueprint comes with an offered test run, and teams can schedule a skill that checks the agent's own tools on a cadence. There is no evaluation harness that scores agent runs against tests, and the sandbox is for trying the product.

Sourcedocs.hyground.ai/user-guide/get-help, check-the-agents-work, create-a-skill and hyground.ai/blog/ai-sre-agent-beyond-incidents-regression-test; docs.hyground.ai/user-guide/check-the-agents-workread 2026-10-25

Obliq acts on Kubernetes and cloud through APIs and playbooks. There is no browser, desktop or computer control.

Sourceavesha.io/obliqread 2026-09-29

A WebFetch tool fetches allowlisted URLs at run time and converts HTML to Markdown. That is a headless fetch, and the agent never sees a browser, a desktop or the user's screen.

Sourcehyground.ai/product/integrations and docs.hyground.ai/user-guide/what-the-agent-can-seeread 2026-10-25