Sherlocks.ai
AI native SRE assistant that correlates observability signals for incident response, root cause and outage prevention, with institutional memory.
Sherlocks.ai brings AI SRE teammates into Slack and Microsoft Teams. Triggered by the alert itself, or by a ticket or a Slack request, it runs 16 or more domain specialized agents in parallel. They map the alert to a knowledge graph of the customer's infrastructure, form a hypothesis, query logs, metrics and traces across 50+ connected tools to validate it, and report the root cause with short and long term remediations, usually in two to three minutes.
It carries institutional memory across infrastructure, past incidents, runbooks and Slack conversations. Its Watson data agent runs inside the customer's VPC with strictly read only permissions. Sherlocks is SOC 2 Type 2 certified, and its Enterprise plan adds SSO, SAML, audit logs, RBAC and air gapped or in VPC LLM options beside a free plan of 30 investigations a month.
Vendor details
Canonical URL
https://www.sherlocks.ai
Category
SRE / DevOps agent
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Slack and Microsoft Teams plus 50+ tools including Datadog, New Relic, Prometheus, AWS, GCP, Azure, Kubernetes and databases, read only.
In practice
A Datadog alert fires in the middle of the night. Sherlocks picks it up, runs its agents against your logs, metrics and traces, and posts the root cause and suggested fixes in Slack.
Security will not give an AI tool write access to production. Sherlocks' data agent runs inside your VPC with read only permissions, and your team carries out the fixes.
Your on call engineers keep rediscovering the same causes. Sherlocks carries memory of past incidents, runbooks and Slack threads into each new investigation.
Sources & related URLs
Research sources
Agentic Index coverage score
7.5 / 14 capabilities · 54%
| Integrations & Tool Calling | Partial |
|---|---|
|
Sherlocks connects to 50+ tools (Datadog, New Relic, Prometheus, AWS, GCP, Azure, Kubernetes, databases) and queries logs, metrics and traces. The Watson data agent runs inside the customer's own VPC with strictly read only permissions, so agents read outside systems and report to Slack or Teams instead of acting in them. Named sources also include Sentry, Coralogix, Elasticsearch, Loki, PostgreSQL, MySQL, MongoDB, Redis, Kafka, RabbitMQ, GitHub Actions and Jenkins. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Workflow Orchestration | Full |
|
Each investigation runs 16+ domain specialized agents in parallel. Sherlocks maps the alert to its knowledge graph, forms a hypothesis, queries logs, metrics and traces to validate it, then reports root cause with short and long term remediations. Findings arrive in Slack or Microsoft Teams. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Knowledge Grounding & RAG | Full |
|
Sherlocks maps each alert to a knowledge graph of the customer's infrastructure and applications, built automatically, that persists across investigations and grounds each hypothesis before it queries telemetry. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Human Oversight & Guardrails | Partial |
|
The data agent has strictly read only permissions, and Sherlocks reports remediations for the team to carry out, so action stays with people. Sherlocks describes no step that presents a fix for approval. Remediations come in short term and long term versions. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Security, Identity & Governance | Full |
|
The Enterprise plan adds SSO and SAML, audit logs and RBAC, with a read only in VPC data agent, and compliance rests on SOC 2 Type 2, with security review support. Data is encrypted in transit and at rest, and the free plan has no SSO, audit logs or RBAC. SourceSherlocks.ai, sherlocks.ai/pricing and sherlocks.airead 2026-10-05 |
|
| Observability & Auditability | Partial |
|
Each investigation reports a root cause with remediations in Slack, and Enterprise includes audit logs, but Sherlocks names no record per investigation of the queries and steps the agents took. Reports also go to Microsoft Teams. SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05 |
|
| Memory & State Persistence | Partial |
|
Sherlocks carries institutional memory across infrastructure, past incidents, runbooks and Slack conversations, so each investigation starts with the context the team has already built up. That memory carries across runs, but Sherlocks does not say what it covers, how long it lasts or how to delete it. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Deployment & Data Residency | Full |
|
The Watson data agent runs inside the customer's own VPC, so raw telemetry never leaves the customer's environment, and Enterprise adds an air gapped deployment option and an option to run the LLM in the VPC. The VPC data agent comes with the free plan too. SourceSherlocks.ai, sherlocks.ai/pricing and sherlocks.airead 2026-10-05 |
|
| Prebuilt Agents, Templates & Packs | Partial |
|
The 16+ domain specialized agents run together inside each investigation, not as agents a customer selects or adopts separately. None of them is named, and the earlier Database Sherlock and Kubernetes Sherlock names no longer appear. Every plan includes all 16+ agents, and Enterprise adds a dedicated field engineer for setup. SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05 |
|
| Triggers & Channel Coverage | Full |
|
The alert itself triggers Sherlocks, which investigates on its own with 16+ domain specialized agents and reports back in Slack, and tickets and Slack requests also start investigations. The free plan covers 30 investigations a month, and Enterprise is unlimited. SourceSherlocks.ai, sherlocks.ai and /pricingread 2026-10-05 |
|
| Model Flexibility & Routing | Not documented |
|
Enterprise offers an 'In-VPC LLM option', so the model can run in the customer's own environment. Sherlocks names no model or maker, and no way to choose between makers. Sourcesherlocks.ai/pricingread 2026-09-29 |
|
| APIs, SDKs & MCP Extensibility | Not documented |
|
No API, SDK or MCP server is published for driving Sherlocks from outside. Teams work with Sherlocks through Slack and Microsoft Teams. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Testing, Debugging & Optimization | Not documented |
|
No evaluation harness, scored tests or improvement loop is named for the agents' investigations. Sherlocks reports MTTR falling from hours to minutes, alert noise down 90% and downtime down 70%. SourceSherlocks.ai, sherlocks.airead 2026-10-05 |
|
| Browser & Computer Use | Not documented |
|
Agents query telemetry through integrations and report in Slack and Teams. Sherlocks names no browser, desktop or computer control. Sourcesherlocks.airead 2026-09-29 |
|
The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded
Product updates
Sherlocks.ai introduced an AI SRE integration for Slack that makes the chat platform a primary incident investigation interface. Upon receiving an alert or an engineer's /investigate command, the agent autonomously correlates cross-service telemetry and tests root cause hypotheses against live infrastructure data. It then posts its findings, blast radius analysis, and remediation recommendations directly into the active Slack thread. The agent remains active in the channel to answer follow-up questions and prepare contextual handoffs for incoming engineers.
Bears on: Agent capability
View sourcePricing
Free (30 investigations a month, self serve); Enterprise custom
Investigations per month on Free; custom Enterprise contract
What is public
The Free plan's limits and inclusions and the Enterprise inclusions; no paid price is published.
Variable cost rationale
Free is capped at 30 investigations a month and the paid plan is custom, so cost at volume is not published.
Overage / add-ons
Not published
Sales call required
Mixed (some tiers require a call)
Free / trial
Free plan: 30 investigations a month, no credit card
Related vendors
- AlertD — AI agents for AWS operations that run read only in the customer's…
- Anyshift — AI SRE built on a versioned knowledge graph of infrastructure, apps…
- Avesha — Obliq, Avesha's autonomous AI SRE for Kubernetes and agentic…
- Better Stack — Better Stack offers incident management with built in on call,…
- Bluebricks — Context and control layer that lets AI agents operate cloud…
- Cased — AI workflows for infrastructure and platform engineers: default and…
Alternatives to Sherlocks.ai
The closest documented capability profiles to Sherlocks.ai among SRE and DevOps agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.
- Metoro9.0 / 14Adds documented APIs, SDKs & MCP Extensibility
- Middleware8.0 / 14Adds documented APIs, SDKs & MCP Extensibility
- Better Stack9.5 / 14Adds documented APIs, SDKs & MCP Extensibility
- Bluebricks10.5 / 14Adds documented APIs, SDKs & MCP Extensibility and Testing, Debugging & Optimization
- Ciroos AI7.5 / 14Adds documented APIs, SDKs & MCP Extensibility and Testing, Debugging & Optimization
- Harness7.5 / 14Adds documented APIs, SDKs & MCP Extensibility
Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded