Edge Delta

About twenty event connectors cover Argo CD, Atlassian, AWS, CircleCI, Databricks, GitHub, GitLab, Grafana, Harness, Jenkins, LaunchDarkly, Linear, Microsoft Teams, PagerDuty, Sentry, Slack and more, about twenty-six streaming connectors cover Kubernetes, Kafka, OTLP, Syslog, SNMP, Splunk, CrowdStrike FDR, Windows Events and cloud object stores, and a destinations library reaches some forty systems across observability tools, data lakes and SIEMs.

Event connectors work in both directions, receiving events from external systems and taking outbound actions such as GitHub pull request operations, Jira issues, PagerDuty incidents and Slack and Teams messages, written directly into those systems rather than handed back to a person as suggestions. Custom remote MCP servers and a Custom API source let customers add their own connections, and the connector classes span CI/CD, incident management, cloud, collaboration, data platforms and security.

Sourcedocs.edgedelta.com/ai-connectors, /event-connectors and /destinationsread 2026-09-08

Two mechanisms coordinate work. OnCall AI is the orchestrating teammate that routes requests to specialists, coordinates workflows across several teammates and synthesizes findings, working across a set of role-specific teammates with de-duplication and handoffs.

The Workflows builder is a node graph with Start, Teammate, Task, If/Else, Transform, Action and Note nodes, where Action nodes cover email, Slack, Jira, Microsoft Teams, PagerDuty and starting an AI conversation, and Edge Delta ships Default Workflows and a Workflow Patterns library. Branching, transformation and conditional routing run across both agents and external systems, and Monitors can invoke workflows.

Sourcedocs.edgedelta.com/workflows-section and /glossaryread 2026-09-08

A Knowledge Graph is a core AI Team component, Knowledge Libraries are configured at pipeline level, and an indexed back end holds logs, metrics, patterns, traces and events that the customer queries through a published Common Query Language.

Around it sit a Log Inventory, Metrics Inventory, Patterns and Anomalies views, a Service Map, log-to-trace correlation, and Rehydrations that pull archived data back into the index. Teammates search this structure through MCP tools for log, metric, trace and event search rather than assembling context for each run, and it persists, scales past the context window and stays queryable. Telemetry Pipelines shape data before it reaches a model.

Sourcedocs.edgedelta.com/knowledge-graph, /knowledge-library and /cqlread 2026-09-08

Teammates are read-only by default and ask before any write action, with restarts and rollbacks named as the kind of operation that needs approval. On the Issue Details page a user approves or denies AI actions and verifies or dismisses the steps they own. Guardrails add a configurable layer with Domain Overrides, a Data Boundary controlling what reaches the model, and a Posture Report, and code execution inside an investigation follows the same permission controls as every other teammate operation. Connector scopes and rate limits set per agent bound what each teammate can do.

Sourcedocs.edgedelta.com/issue-details, /guardrails and /ai-team-securityread 2026-09-08

SAML handles authentication and authorization, with an implementation guide and six identity providers covered individually (Azure AD, Okta, Cisco Duo, Google, OneLogin, Ping Identity).

Administrators manage Users and Groups and API tokens, role-based access control extends to RBAC scoped to Packs, each teammate has its own connector scopes and rate limits, and cloud identity integrates through AWS IAM roles and service accounts, AWS assumed roles, GCP authentication and Kerberos. Secrets management with master-key encryption sits underneath.

Edge Delta holds SOC 2 Type II, and its trust center at trust.edgedelta.com covers data handling and AI model provider policies, alongside a Strengthening Security and Compliance page.

Sourcedocs.edgedelta.com/saml-integration, /users, /api-tokens and trust.edgedelta.comread 2026-09-08

Audit Logs under Administration record Edge Delta activity, and the platform's own audit logs can be ingested back through a pipeline, so the record can be exported into the customer's SIEM rather than staying in a console. Around it sit an Activity view in the AI Team, AI Team Events, per-thread detail showing what the agent did and what it consumed, an AI Overview dashboard covering live AI Team activity, and Issue Details, where each recommended step can be verified or dismissed by its owner. Every agent action is logged, so an investigation can be reconstructed afterward.

Sourcedocs.edgedelta.com/audit-logs, /ingest-audit-logs and /activityread 2026-09-08

Teammates keep memories from prior work in two scopes. Memories shared across the organization draw on previous analysis findings, so a similar pattern investigated before speeds up the current investigation, and personal memories hold an individual user's preferred analysis approaches and prior decisions.

Each can be toggled independently, retention policies are set in settings, and turning memories off or expiring them destroys no business record. Teammates learning what normal looks like across services, and historical baselines, belong to the anomaly detection model rather than to memory. Separately, the sandbox workspace persists across sub-steps within one investigation, and threads retain full history for handoffs.

Sourcedocs.edgedelta.com/ai-team-sandbox and /ai-team-settingsread 2026-09-08

The pipeline and processing tier installs into the customer's own infrastructure, with paths for Kubernetes (Helm, kubectl, manifests, OpenShift, SELinux-enforced clusters), Linux, Docker, Amazon ECS, macOS and Windows, plus a Terraform provider, GitOps, multi-tenant and multi-cluster patterns, in-cluster processing, in-cluster destinations, a Local Storage destination and a Guardrails Data Boundary.

That gives the customer control over where telemetry is processed and what leaves its estate. The AI Team itself runs its control plane in Edge Delta's cloud, where the sandbox for each investigation is provisioned, and it cannot be self-hosted, has no region list and offers no option to run in the customer's environment.

Sourcedocs.edgedelta.com deployment patterns, in-cluster processing and ai-team-sandboxread 2026-09-08

Six specialized teammates ship out of the box, AI SRE, Security Engineer, Software Engineer, Work Tracker, DevOps Engineer and Cloud Engineer, each with its own production-ready system prompt, connector scopes and channel access. Separately, Packs are a product feature with a browsable Packs Catalog of roughly forty-three entries (Akamai, ArgoCD, Auth0, AWS CloudTrail, Cisco ASA, Cloudflare, Fortigate, Istio, Nginx, Okta, Palo Alto, Splunk Rosetta Stone, ZScaler and the rest), a Packs Library, and flows to create a pack, create one from an existing pipeline, add one to a pipeline, deploy changes to active packs and configure RBAC per pack.

Sourcedocs.edgedelta.com/pack-catalogue and /specialized-teammatesread 2026-09-08

A monitor alert, a PagerDuty incident or an event connector starts an investigation thread with no acknowledgment step in between.

Threshold, change, anomaly, pattern-anomaly, composite and synthetic monitors can each trigger an AI Team workflow or post into an AI Team channel, pipeline triggers fire at the edge for lowest latency, and about twenty event connectors listen to CI/CD, incident and code-hosting systems. Streaming connectors add inbound queues and listeners including Kafka, Azure Event Hub, Pub/Sub, SNMP Trap, Syslog and HTTP.

People reach the AI Team through its Channels and Direct Messages, Slack, Microsoft Teams, email, PagerDuty and webhooks, and events, schedules and inbound queues all start work.

Sourcedocs.edgedelta.com/monitors, /send-to-workflow and /event-connectorsread 2026-09-08

Teammates can run on Anthropic, OpenAI or Google models. The platform is model-agnostic across all three, so administrators can switch models, attach a distinct foundation model to each teammate to match model to role, and stay current through a maintained model catalog. The trust center lists policies for multiple AI model providers. AWS is the cloud host, not an additional model provider.

Sourcedocs.edgedelta.com/teammates, held from 2026-07-08 launch and documentation basis, re-stampedread 2026-09-08

A public REST API at api.edgedelta.com/v1 has an interactive Swagger reference, API token and organization ID setup, endpoints to retrieve, update, validate and deploy pipeline configurations and to query metric timeseries for external integrations, an error table, and a complete OpenAPI 3.0 specification available for download at api2.edgedelta.com/swagger/doc.json. Alongside it are an edx CLI with a full command reference, a Terraform provider, and Deputy-style embedding through Cloud Pipelines.

The Edge Delta MCP server, published as Connect AI Agents to Edge Delta, lets an outside agent drive the platform, with tools for log, metric, trace and event search, pipeline management, live capture and processor dry runs. It is separate from the outbound custom remote MCP connector, which lets teammates use other systems, and from the internal MCP connector that bridges teammates to Edge Delta's own data.

Sourcedocs.edgedelta.com/api and /edge-delta-mcp-serverread 2026-09-08

A Performance page tracks teammate scores, response times and token usage per thread. The AI Team Sandbox, despite its name, is not for evaluation; it is a secure isolated code-execution environment OnCall AI uses during investigations, spinning up when tool results exceed roughly 10,000 characters so the agent can write Python or Bash to analyze data it could not otherwise fit in context.

The pipeline release path gates changes through validate, save, version and deploy, with /confs/validate returning a valid flag and reason, which confirms a configuration installed correctly rather than that the agent behaves acceptably. Teammate Version History records what changed without scoring it, and Edge Delta does not describe scored test cases, a pre-deployment harness or a controlled optimization loop for teammate behavior.

Sourcedocs.edgedelta.com ai-team-performance, ai-team-sandbox and api-exampleread 2026-09-08

The closest thing to computer use is the AI Team Sandbox, which gives every investigation an isolated code interpreter with file system access, bash commands, the ability to write, compile and run Python or Bash, local storage for large tool outputs, and Git repository cloning to analyze full codebases, and which is deprovisioned when the investigation ends. The Exec source node runs scripts and commands to collect logs. Edge Delta offers no hosted or local browser, desktop session or remote computer control, and teammates reach outside systems through connectors and APIs instead.

Sourcedocs.edgedelta.com/ai-team-sandbox and /exec-input-noderead 2026-09-08