Keel watches your logs for the conditions you care about, opens a scoped incident the moment one trips, and automatically runs root cause analysis — grounded in your own runbooks. No query language to learn, and the AI never sits in the detection loop.
Detection isn't a separate product bolted on — it's the front of the same pipeline that ingests and stores your logs. Each stage is deterministic and explainable.
syslog, JSON, CEF, LEEF, logfmt, OpenTelemetry — parsed natively into a common shape.
A compiled matcher stamps each line — disk-full, OOM, 5xx, auth-failure and more — as it arrives.
Rules evaluate against a per-minute rollup every 60 seconds: threshold, anomaly, absence, pattern.
One incident per affected host or service — with the trigger, host and severity, not a wall of alerts.
A host-scoped RCA runs automatically, citing the evidence and your runbooks.
Turn on a curated starter pack with one toggle, or describe your own detection in a sentence. Each compiles to a deterministic check — fast, explainable, and identical every run.
Error volume, 5xx surges, connection-pool exhaustion, failed-login bursts — fires when a count crosses your line, per service or per host.
A spike detector compares the current window to a rolling multi-day baseline and fires on a statistically significant jump — no fixed threshold to guess.
A service that always logs suddenly goes quiet — a likely crash or hang — caught by watching for the logs that stopped.
Match any substring or regex — a panic, a stack trace, a known-bad line — and open an incident the first time it appears.
Expect a specific line — a nightly job's "OK", a health check — and fire when it fails to appear in the window.
SQL injection, path traversal, XSS probes, privilege escalation and credential-access attempts — shipped as signals, tagged at ingest.
Type alert me when checkout errors spike on any host and Keel compiles it into a rule once, using your runbooks for context — then evaluates it deterministically every cycle. The AI writes the rule; it never runs in the detection loop. That's what keeps detection fast, explainable, and identical every single run.
Keel ships a curated pack of common operational and security detections and lets you define your own in plain English. It is not a comprehensive SIEM detection-content ecosystem — no thousands of third-party correlation rules or threat-intel feeds. If your security practice is built on a large detection library, keep it; Keel covers the operational detection and automatic root-cause layer underneath.
A traditional alert tells you a number crossed a line. A Keel incident names the host it came from, what tripped it, whether it has recovered, and the root cause — before you've opened the page.
Disk exhaustion on phost1 blocked log & auth writes. The volume holding /var/log filled; journald and btmp writes failed, cascading into the auth failures seen on the same host. Remediation: reclaim space or extend the volume, then clear the read-only block.
Every incident carries the originating host as a first-class field — filter a fleet of thousands down to the one machine in trouble. One incident per affected host or service; independent conditions never collapse into each other.
Recovery is tracked honestly: active until the errors stop, then recovered — automatically, by an operator, or from your monitoring — with flap-dampening so a bursty error doesn't churn. A recurrence opens a fresh incident.
"Detected by rule X — this condition, on this host." You always know which rule fired and why, and can click straight through to tune it.
Everything detection depends on, Keel already does — the same appliance ingests, stores, searches, and investigates. Detection and auto-RCA sit on top of a full log-management stack, not beside it.
OpenTelemetry, syslog and Fluentd — plus JSON, CEF, LEEF and logfmt — parsed natively into a common shape, no brittle field extraction to maintain.
Ask your logs a question in plain English and Keel writes and runs the query — or drop to a raw query when you want precision.
Every incident auto-runs a read-only root-cause analysis grounded in your runbooks, with findings sent to Slack, PagerDuty or email.
A single VM appliance. RCA runs against the AI model you choose — your own Anthropic or OpenAI key, any OpenAI-compatible endpoint, or a fully local model. Choose local and it operates fully air-gapped, with nothing leaving your network.
Turn on the starter pack, or write a rule in a sentence. Keel does the watching, the correlating, and the explaining — entirely on your own hardware. See the single-node numbers on the performance page.
Try the live demo Book a walkthrough