Logz.io

Agents act in outside tools through a catalog of more than 600 integrations, each connected with the provider's API key or with an email and token. Access starts read only, and writing takes two switches: an admin sets the whole account to Read & Write in OrionIQ settings, then each connection that supports actions gets Read & Write of its own.

With both on, a runbook step can open a Jira issue, add a PagerDuty note or update a Logz.io alert. Scoped Logz.io API access at Read, Write or Admin lets an agent create and update Logz.io objects, and results go out to email, Slack, Microsoft Teams or custom webhooks.

Sourcedocs.logz.io/docs/user-guide/orioniq/integrationsread 2026-11-09

Every agent follows a mandatory runbook whose steps run in order and can branch on what earlier steps found, calling any integration action the agent may write to.

The deep Logs + Metrics tool set adds a coordinating agent that plans the investigation, hands parts to specialized logs, metrics and integration sub agents, picks each next step from the last result and merges their findings. Agents can also call other specialized agents, so one alert, deployment or API call can set off a chained investigation. A flat JSON schema can fix the shape of the output for downstream systems, and follow up questions continue the same session.

Sourcedocs.logz.io/docs/user-guide/orioniq/create-agentread 2026-11-09

Each run gathers its context at run time: telemetry from the Logz.io accounts the agent may query, the alert description it reasons against, and documents fetched through connectors, so a runbook kept in Confluence or GitHub is pulled at its current version on every invocation. Compressed log metadata keeps that telemetry quick to search. Memory documents in Markdown, up to 1 MB each, can hold uploaded runbooks, architecture notes and service owners, but they shape chat answers only, and agents do not read them yet. No standing index built over the customer's own documents feeds the agents.

Sourcedocs.logz.io/docs/user-guide/orioniq/memoryread 2026-11-09

Control sits in permissions and limits. Agents read by default, and only an admin can open write access, first for the whole account and then connection by connection, so nothing reaches Jira, PagerDuty or a Logz.io alert unless both allow it.

Admins also set a monthly AI budget, daily invocation and token limits and per agent caps; read only users cannot create, trigger or stop agents; and any running invocation can be stopped. Incident Triage calls an incident resolved only when the trigger is gone and a runbook fix is in effect, and otherwise hands it to a person. No step asks anyone to approve an individual action before it runs.

Sourcedocs.logz.io/docs/user-guide/orioniq/integrationsread 2026-11-09

Sign in runs through SSO with Okta, Azure, Google Workspace, OneLogin, Auth0 or AWS, and SSO groups map people to the Read Only, User, Expert User or Admin role, with a SIEM role beside them. MFA, IP login restrictions and API tokens limited to view, create or edit round out access.

Inside OrionIQ, read only users can browse agents and runs but cannot build, run or connect anything, and only admins grant agents write access or change spending caps. Logz.io holds SOC 2 Type 2 and PCI Level 1 compliance and ISO 27001 certification, states HIPAA and GDPR readiness, and encrypts data at rest with AES 256 keys in AWS KMS.

Sourcedocs.logz.io/docs/user-guide/admin/sso/single-sign-onread 2026-11-09

Every invocation keeps three views: the input with the agent's instructions, accounts and filters; the analysis, a step by step record that labels each AI reasoning step and each tool step such as a log query; and the final report. Findings in an alert analysis carry the query behind them, so anyone can rerun it.

The Agents Hub shows who created and last changed each agent and when it last ran, connection records show who connected each integration and which agents use it, and the account audit trail logs user actions with IP address, location and time. A usage dashboard tracks invocations and cost per agent.

Sourcedocs.logz.io/docs/user-guide/orioniq/agents-hubread 2026-11-09

Written feedback on a finished run becomes a lesson: a background reflection rereads that run, finds the decision behind the outcome and writes at most one rule with its situation and reason, which every later run of that agent in that account receives beside the runbook.

Lessons stay with one agent in one account, each agent keeps up to 20 active ones, and any lesson can be reviewed, switched off, restored or removed, while pausing learning keeps them without using them. Account and personal memory documents carry service owners and conventions into chat, and only admins edit the account file.

Sourcedocs.logz.io/docs/user-guide/orioniq/create-agentread 2026-11-09

Customers pick the AWS region for a new account: US East (Northern Virginia), Europe (Frankfurt), Europe (London), Asia Pacific (Sydney) or Canada (Central), and the account, its listener and its API stay in that region. OrionIQ settings show where account data and the serving model are hosted, both fixed at provisioning. The model runs in the account's own region where AWS allows, with Canada accounts served from US East and London accounts from Frankfurt. Data in each region spans several availability zones, and moving an account means opening a new one in the target region.

Sourcedocs.logz.io/docs/user-guide/admin/hosting-regions/account-regionread 2026-11-09

A Marketplace of agent templates installs in one click, each a separate agent with its own job and trigger: Alert AI Analysis on every firing, Root Cause Analysis and Incident Triage on demand, Alert Digest and Alert Tuning Report weekly, and Error Logs Analysis and Log Distribution Monitor daily.

The seven templates listed today cover incident, alerting and performance work, inside a catalog that also has deployment, compliance and detection categories. A template can be activated several times with different data sources and recipients, opens into the complete agent settings form for changes, and a wish list gathers requests for new ones.

Sourcedocs.logz.io/docs/user-guide/orioniq/marketplaceread 2026-11-09

Four trigger types start an agent with nobody at a keyboard: a triggered Logz.io alert, a detected deployment event, a schedule such as every three hours or once a day, and a call to the OrionIQ API from a CI pipeline or incident tool. Switching on AI Agent Analysis for a log alert, metric alert or Cloud SIEM security rule creates an agent that runs on every firing, and Investigate with AI runs it on any earlier event. People can also start a run with Test Manually, put a question to OrionIQ chat from a drawer on any Open 360 AI page, or invoke agents from an assistant through the MCP server.

Sourcedocs.logz.io/docs/user-guide/orioniq/create-agentread 2026-11-09

Every OrionIQ run uses models Logz.io chooses: commercial models from Anthropic's Claude family, served through AWS Bedrock in a private instance, with no model setting for the customer in agents, chat or the API. Settings show only where the serving model is hosted, fixed when the account is provisioned. Agent tool sets decide what data an agent can query, not which model reasons over it. Anthropic and AI21 Labs appear in the integration catalog as services an agent can call, and assistants reaching Logz.io through its MCP server run on whatever model the customer's own client brings.

Sourcedocs.logz.io/docs/open360/observability/faqread 2026-11-09

The OrionIQ API lets outside systems run an agent, poll its status, send follow up questions in the same session, enable or disable it and submit or read feedback scores, authenticated with an account API token on regional hosts. The Logz.io MCP server exposes tools to list, invoke and read OrionIQ agents beside log search, PromQL queries, alerts and dashboard creation and updates, with OAuth 2.0 and PKCE for clients such as AWS Bedrock Agent. The Logz.io public API covers accounts, alerts and dashboards, and each API token can be limited to view, create or edit.

Sourcedocs.logz.io/docs/user-guide/orioniq/apiread 2026-11-09

Test Manually runs an agent on a context the team supplies before anyone relies on it, and any finished run can be invoked again, so a rewritten runbook can be checked against the same input.

Every run takes a thumbs rating and a note in the product, or a score from 0 to 100 sent through the feedback API from a pipeline, and the Usage and Performance dashboard tracks average feedback score, feedback coverage, invocation volume and cost per agent, with a trend chart showing whether results improve. Runs end as success, failed, stopped or incomplete with the reason shown, so a struggling agent stands out.

Sourcedocs.logz.io/docs/user-guide/orioniq/usage-performanceread 2026-11-09

OrionIQ works through queries and integration APIs and never drives a browser or desktop. Its tool sets reach logs, metrics and connected services, connectors sign in with API keys or tokens, and actions such as opening a ticket or updating an alert go through each platform's API. Investigations run on Logz.io infrastructure against telemetry customers have already shipped, and the Logz.io mobile app gives people another way into chat and results without giving the agent a screen to operate.

Sourcedocs.logz.io/docs/user-guide/orioniq/integrationsread 2026-11-09