Hyground vs Resolve AI (2026)

Read only adapters reach Kubernetes, AWS, Azure and Google Cloud, Argo CD and Flux, Loki, OpenSearch, Elasticsearch, Graylog and Splunk logs, Prometheus, InfluxDB and Nagios metrics, Jaeger traces, PostgreSQL, MySQL, Oracle, MongoDB, Redis and ClickHouse, RabbitMQ and Kafka, and documentation in Confluence, Git and Artifactory, plus the customer's own HTTP APIs and in cluster MCP servers.

Scoped writes reach Jira, ServiceNow, PagerDuty, ilert, GitHub, GitLab, Slack, Teams and email, so findings come back as tickets, comments, pull requests and answered threads. Adapters run in the customer's cluster and refuse to start if their principal can write.

Sourcehyground.ai/product/integrations and hyground.ai/product/architectureread 2026-10-25

An integration catalog of about 40 systems covers AWS, GCP, Azure, Datadog, Dynatrace, Splunk, Grafana, New Relic, PagerDuty, ServiceNow, Sentry, Snowflake, GitHub, Atlassian, Slack and Microsoft Teams, plus any connected MCP server. On approval the agent creates silences, downtimes or mutes in Grafana, Datadog, AlertManager, Kloudfuse and Sumo Logic, opens fix pull requests and dispatches GitHub Actions workflows.

SourceResolve docs llms.txt index, Mitigation Actions and Security and Administration; docs.resolve.ai/mitigation-actionsread 2026-10-22

A multi agent system plans each investigation, sends specialised agents to work logs, metrics and knowledge in parallel, and aggregates what they find into one answer, with a card per sub agent in the Tools panel. Investigations fan out across every cluster or cluster group the customer runs. Teams turn procedures into skills that run the same steps every time, on demand, from a schedule or loaded by the agent when a skill's When to use line matches, and the customer defines those steps.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/glossary and run-a-skillread 2026-10-25

A team of domain-specialized agents investigates in parallel, pursuing hypotheses that engineers can redirect, and verifies findings against production evidence, with a dedicated reviewer validating them. Custom agents compose Resolve's MCP, API and skills into the customer's workflows, and Temporal connects orchestration platforms.

Sourceresolve.ai/product/incidentsread 2026-10-22

Herald, Hyground's notification gateway, takes any JSON posted to one endpoint, from Alertmanager, Grafana, Datadog, PagerDuty, GitHub, Jira, ServiceNow, cron or curl, checks it for prompt injection and opens an Auto RCA when it describes an incident. People also start sessions from Slack, Microsoft Teams or email, schedules run saved tasks from every five minutes to monthly, and a watch repeats a check inside one session at an interval for up to 24 hours.

Sourcehyground.ai/product/triggers, docs.hyground.ai/user-guide/sessions-hyground-starts and schedule-a-sessionread 2026-10-25

The On-call Agent goes on call on the customer's behalf, holding the pager and triaging alerts. Alerts arrive by PagerDuty, Splunk On-Call and alert webhooks from any source. Tasks run on a schedule or cron, when a matching message appears in a watched Slack or Microsoft Teams channel, or on demand, and the Teams app investigates alerts posted to alert channels.

Sourcedocs.resolve.ai/tasksread 2026-10-22

A knowledge base holds the customer's runbooks, documentation and past investigations, embedded for retrieval inside the customer's cluster. Administrators import what goes in, wiki pages, documentation files from Git repositories, files from Artifactory and uploaded documents, and the content is as current as the last import. The agent searches it on its own while it writes a reply, alongside live cluster state, and each search shows in the Tools panel with the words searched and the matching passages, each naming the document it came from.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/how-the-agent-uses-knowledgeread 2026-10-25

Team Knowledge is a maintained store of runbooks, docs, dashboard guidance and skills at organization, team and personal level that Resolve activates dynamically during investigations, examining all knowledge tied to the alert and its owning teams. Skills follow the open Agent Skills format and load on demand, and Hivemind adds production state awareness across alerts and incidents.

Sourcedocs.resolve.ai/team-knowledgeread 2026-10-22

Inside a session the agent works from its full history, condensed into a summary when a session runs long. Across sessions, recall brings content from the user's own past sessions and every shared session into a new one when the user points the agent at earlier work, and never reads another user's private session. The knowledge base also holds past investigations embedded for retrieval, and the agent's writes include its own knowledge base. No memory the agent keeps for itself with a stated lifetime and a place to review or edit it is described.

Sourcedocs.hyground.ai/user-guide/what-the-agent-remembers, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

The agent keeps learnings it has accumulated, which its tasks can read, and proposes new runbooks and edits to team docs from a conversation or by reviewing completed investigations for lessons. Resolve does not say how those learnings are stored, reviewed or deleted, and Team Knowledge itself is written by people.

Sourcedocs.resolve.ai/tasksread 2026-10-22

The agent is read only by default, and adapters enforce that below the model. Administrators allow selected write actions and decide which need confirmation; for those the agent shows an Action Confirmation Required card with the operation and the full command, which only the session owner can approve or deny, and the offer expires after 15 minutes by default. A mail or chat message is shown before it goes out unless the user asked for the send outright. Sessions from schedules and Auto RCAs have no owner, so no one can approve a write in them. Hyground does not claim remediation today.

Sourcedocs.hyground.ai/user-guide/whose-access-the-agent-uses and hyground.ai/use-cases/nis2-doraread 2026-10-25

Alert silences and fix pull requests run only after a person approves them in the Resolve UI or Slack. GitHub Actions workflow tools, in preview, also default to approval, and an admin can let an individual tool run on its own. The model that proposes actions never calls write APIs, which a separate engine executes, and write permissions are enabled per integration.

Sourcedocs.resolve.ai/security-and-administrationread 2026-10-22

Hyground is ISO/IEC 27001:2022 certified and publishes a CycloneDX software bill of materials with every release. Sessions, queries and actions tie to a named user through OIDC single sign on (Entra ID, Zitadel or any OIDC provider), automation runs under scoped technical users with the same audit trail, and administrators assign roles that decide which connected systems and features each user may use. Tool responses pass a secret filter before the model sees them, and images are Chainguard distroless, non root and read only.

Sourcehyground.ai/product/security, hyground.ai/use-cases/nis2-dora and docs.hyground.ai/user-guide/personalize-hygroundread 2026-10-25

Customers get SSO (Google, Okta, Azure AD), SCIM directory sync with sign in enforcement, RBAC, access limited to roles, environments or namespaces, and audit logs. Compliance covers SOC 2 Type II, GDPR and HIPAA, backed by a trust center.

SourceResolve security page and docs llms.txt index (Security and Administration pages); resolve.ai/securityread 2026-10-22

A Tools panel on each reply lists every tool call and knowledge search, Show command reveals exactly what the agent ran and Show response what each system returned, and the reasoning view shows the agent's thinking as it works. Every investigation, query and finding produces a structured, exportable record that compliance teams can audit, every step is recorded and replayable, sessions export with their files, and a post mortem draft is written from the investigation.

Sourcedocs.hyground.ai/user-guide/how-the-agent-answers, hyground.ai/product/security and hyground.ai/product/architectureread 2026-10-25

Each investigation shows an Evidence Trail with timestamps and verification and a Workbench of what each agent is doing. An Activity Dashboard records every action, including who proposed it, who approved or rejected it, when, and what was affected.

Sourcedocs.resolve.ai/mitigation-actionsread 2026-10-22

Hyground installs from one Helm chart into the customer's own Kubernetes cluster (AKS, EKS, GKE, OpenShift, K3s or on premises) and stays there, the agents, knowledge base, audit trail and model connection included, with everything stored in the customer's own PostgreSQL. There is no SaaS control plane, phone home or vendor access path, the license validates offline, images mirror into air gapped registries, and each connected environment runs a small outpost gateway. The only outbound traffic is the prompt to the model the customer chose, and with a self hosted model nothing leaves.

Sourcehyground.ai/product/security, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Customers choose between a shared multi tenant cloud and a dedicated single tenant cloud deployment with bring your own keys. The Satellite agent runs in the customer's Kubernetes or ECS, keeps credentials local and proxies queries into Resolve's cloud. There is no region list or customer environment option.

Sourcedocs.resolve.ai/resolve-satelliteread 2026-10-22

System skills ship with Hyground, always active and read only, and a Skill blueprints page offers ready made use cases, filtered by tags and marked when the skill needs write access. Choosing one has the agent explore the environment, check the blueprint's assumptions against it, gather the setup details it needs from the user, write the skill with them and offer a test run. Named jobs include incident investigation, cost analysis, CVE blast radius, RBAC drift, cluster right sizing and NIS2 and DORA reporting. Teams also write and share their own skills, versioned and grouped by category.

Sourcedocs.hyground.ai/user-guide/create-a-skill, run-a-skill and hyground.airead 2026-10-25

Separately named agents ship for their own jobs, namely the On-call Agent that holds the pager and triages alerts, the Incident Resolution Agent for root cause and mitigation, and Issue Remediation for recurring problems. Background agents for operational tasks start from a template library that includes a deploy health monitor, a daily digest, an alert triager and a resource report.

Sourceresolve.ai/product/operational-tasksread 2026-10-22

Agents reach their model through LiteLLM, with a primary and a fallback, so the customer picks Azure OpenAI, OpenAI, Anthropic, Google Gemini on Vertex AI or AI Studio, AWS Bedrock, Azure AI Foundry, OpenAI compatible endpoints such as vLLM, Scaleway, Together or Fireworks, or a self hosted model through Ollama, and swaps providers without touching the rest of the system. Model costs are paid to the provider under the customer's own contract.

Sourcehyground.ai/product/architecture, hyground.ai/product/integrations and hyground.ai/use-cases/nis2-doraread 2026-10-25

Resolve uses frontier LLM models combined with domain-specific models, without naming a provider, and customers cannot choose a model.

Sourceresolve.airead 2026-10-22

Herald's single webhook endpoint (/api/herald/webhook) lets any outside system that can POST JSON start an investigation, and the architecture page lists Claude Code, Cursor and any MCP client among the signals that reach Hyground. There is no API reference, SDK or Hyground MCP server documented with an endpoint and authentication, and the customer MCP servers and HTTP APIs it connects to are integrations the agent calls.

Sourcehyground.ai/product/triggers and hyground.ai/product/architectureread 2026-10-25

A REST API at app0.resolve.ai with bearer personal or organization tokens triggers, lists and reads investigations, alongside a Resolve MCP server, plugins for Claude Code, Codex and Cursor, and skills in the open Agent Skills format.

Sourcedocs.resolve.ai/resolve-rest-apiread 2026-10-22

Users rate replies up or down, with reasons such as inaccurate, missing context or made up, and guidance shows how to check each claim against a tool result. A skill written from a blueprint comes with an offered test run, and teams can schedule a skill that checks the agent's own tools on a cadence. There is no evaluation harness that scores agent runs against tests, and the sandbox is for trying the product.

Sourcedocs.hyground.ai/user-guide/get-help, check-the-agents-work, create-a-skill and hyground.ai/blog/ai-sre-agent-beyond-incidents-regression-test; docs.hyground.ai/user-guide/check-the-agents-workread 2026-10-25

A change can be evaluated against an earlier result. After updating knowledge or integrations, Reinvestigate alert re-runs the same alert so the new result can be compared against the original, and thumbs up or down verdicts on each report collect under Analytics, Feedback.

Sourcedocs.resolve.ai/tuning-accuracyread 2026-10-22

A WebFetch tool fetches allowlisted URLs at run time and converts HTML to Markdown. That is a headless fetch, and the agent never sees a browser, a desktop or the user's screen.

Sourcehyground.ai/product/integrations and docs.hyground.ai/user-guide/what-the-agent-can-seeread 2026-10-25

Work runs through integrations, a Satellite proxy, Slack, Microsoft Teams, a REST API and an MCP server, with no browser, desktop or computer control.

SourceResolve docs llms.txt index and Incidents page; resolve.ai/product/incidentsread 2026-10-22