KeepHQ

As the complexity of IT systems continues to grow, so does the volume of alerts generated by observability tools. While this proliferation of data offers unprecedented insights into system performance, it also introduces significant challenges for alert management. In this article, we explore KeepHQ, an open-source platform that addresses these challenges through advanced alert aggregation, filtering, enrichment, and automation capabilities. Drawing from its innovative architecture and growing ecosystem of enterprise features, we examine how KeepHQ helps organizations manage their alert environments more efficiently while maintaining operational control.

Overview and Features

KeepHQ's core functionality centers on aggregating alerts from multiple observability tools into a centralized interface. The platform excels at managing the proliferation of alerts generated by modern observability setups, with the 2023 Grafana Observability Survey highlighting that over 52% of companies employ more than six observability tools.

The platform's Alert Filtering capabilities offer extensive customization options. Users can filter alerts by service, severity, and custom attributes, enabling precise targeting of relevant events. KeepHQ also provides advanced filtering options like ticket correlation and real-time data synchronization, which can be crucial for maintaining an efficient incident response process.

When it comes to Alert Enrichment, KeepHQ stands out for its flexibility across various data sources. Users can integrate customer information from databases, enhance alerts with ServiceNow data, or perform complex operations using Common Express Language queries. For instance, an alert command might enrich customer details by integrating with MySQL: keep alert enrich --fingerprint <alert_fingerprint> customer_id=<customer_id> ticket_id=<ticket_id> customer_email=<customer_email>, demonstrating the platform's powerful data manipulation capabilities.

The platform's workflow system represents its most innovative feature set. Built on a YAML-based architecture, these workflows function similarly to GitHub Actions, allowing users to define automated processes that trigger in response to specific alerts. Real-time execution capabilities mean that workflows can immediately perform actions like updating Jira tickets or running Python scripts, all while maintaining the traceability and version control benefits of code-based deployment.

In its enterprise-focused capabilities, KeepHQ integrates sophisticated AI-driven tools for alert correlation and summarization. These features are particularly valuable in environments generating thousands of daily alerts, where traditional monitoring tools struggle to maintain relevance and actionable insights. Unlike proprietary AIOps solutions, KeepHQ's AI functionalities operate within an open-source framework, allowing continuous community-driven improvements and adaptation to evolving operational needs.

Installation and Configuration

The platform supports installation via Docker, with options for both local and Kubernetes environments. Users can install the Keep CLI using either poetry or pip, providing flexibility for different development workflows. Additionally, Docker installation options are available, making it straightforward to get started. For secure production use, Keep requires proper authentication, with the default docker-compose configuration allowing basic operation without an API key. However, production deployments must configure authentication according to the official documentation.

Provider and Data Integration

The platform implements bi-directional alert synchronization between KeepHQ and third-party tools, supporting integration with monitoring systems, incident response management (IRM), ticketing platforms, source control, change management, and configuration management databases (CMDB). Current integration capabilities include AppDynamics, Datadog, Jira, and PagerDuty, with support for additional tools through an extensible architecture.

KeepHQ's data collection strategy centers on Common Express Language (CELL) for advanced querying, slicing, and analysis. The platform employs CELL to implement rule-based grouping of alerts, reducing noise and improving data clarity. Underpinned by a robust query infrastructure, Keep supports direct MySQL database queries for alert enrichment and automation processes. For instance, users can enhance alert context by executing SQL commands to retrieve relevant customer information: keep alert enrich --fingerprint <alert_fingerprint> customer_id=<customer_id> ticket_id=<ticket_id> customer_email=<customer_email>.

The system's automation capabilities enable real-time execution of complex workflows, integrating directly with GitHub Actions for seamless deployment into CI/CD pipelines. These workflows define automated processes triggered by specific alert conditions, demonstrating the platform's programmability through custom YAML configurations. Advanced features include the ability to update Jira tickets and execute Python scripts in response to alert events, providing organizations with a flexible foundation for their alert management strategies.

Workflow Automation

KeepHQ's workflow automation system operates on a YAML-based architecture that closely mirrors GitHub Actions' structure, providing a programmable framework for incident response operations. Each workflow consists of triggers and steps/actions that define automated processes in response to specific alert conditions.

The workflow engine supports multiple execution paths, allowing for complex decision-making based on alert attributes and conditions. For example, a workflow might be configured to only execute on critical alerts and include filtering mechanisms using regular expressions to match specific alert attributes. The system then proceeds through a series of steps that can include data enrichment, ticket creation, script execution, and more.

A practical example of workflow execution demonstrates the system's capabilities. In this scenario, a workflow processes an alert by first enriching its details using a MySQL query to retrieve relevant customer information. The workflow then creates a ServiceNow ticket if one does not already exist and meets specific criteria related to the customer's tier level. The entire process runs successfully in just 69 seconds, automatically updating the alert with relevant ticket information and creating a traceable record of the incident response process.

This automated approach significantly reduces response time and operational overhead compared to manual ticket creation processes. The YAML-based configuration allows for modular development and version control, making it easier to maintain and audit automated response procedures. By treating alerts as code, KeepHQ enables organizations to implement and version their alert-response workflows systematically.

Enterprise Features and AI Integration

Designed for both small teams and enterprises, KeepHQ incorporates advanced AI-driven features that significantly enhance alert management capabilities. The platform's AI capabilities focus on next-generation AIOps, offering sophisticated alert correlation and summarization tools that help organizations manage the growing volume of daily alerts, particularly in complex environments.

Key AI-driven features include continuous performance enhancement through AI technology and a robust feedback loop that enables ongoing improvement. The platform supports customizable alert correlation and summarization workflows, providing users with the flexibility to tailor these processes to their specific operational needs. These enterprise features are maintained by a growing community of Keepers, contributing to the platform's ongoing development and adaptation to changing operational requirements.

The AI capabilities demonstrate KeepHQ's commitment to democratizing AIOps through open-source innovation. While the platform offers sophisticated enterprise features, it remains accessible to teams of all sizes, from small development teams managing local Prometheus alerts to larger organizations with diverse IT infrastructure. This scalability, combined with continuous improvements based on user feedback, positions KeepHQ as a practical solution for modern incident response and operational management.