Request early access

The AI production commander: incident management, on-call, triage and investigation in one.

Every alert triaged before anyone is paged.

Noci AI manages production for the business, not just for the engineers.

  • Noise scored and suppressed, each with its reason.
  • Related alerts and the deploy, joined into one incident.
  • The owner paged with what broke and what to try.

See how it works

Triage Northwind Payments
  1. INC-2318 SEV-2 3 alerts and 1 deploy, correlated by Soren
  2. P1 Error rate above 2% on checkout-api Datadog · APM 4% flaky
  3. P3 Disk usage above 85% on settlement-batch Datadog · Metric Resolution: Clears on its own in under 3 minutes 91% flaky
  4. P2 p99 latency above 2s on payments-gateway Datadog · APM 9% flaky
  5. P4 CPU steal above 10% on node pool b Alertmanager · Kubernetes Seasonality: Fires every night around 02:00 86% flaky
  6. P3 Pod restarts on notifications-worker Alertmanager · Kubernetes Recurrence: Fired 38 times in the last 7 days 83% flaky
  7. P2 Connection pool wait above 500ms on ledger-writer CloudWatch · Database Monitoring 6% flaky
  8. P4 Synthetic login slower than 3s on merchant-portal Datadog · RUM Anomaly: Inside its normal range for this hour 81% flaky
  9. Δ ledger-writer v2.31.0 deployed at 02:06 GitHub Actions · what changed
  10. Suppressed with reasons 4
  • open_war_room #inc-2318-checkout-api
  • continue_investigation Soren keeps working the theory
  • acknowledge Priya Raman · escalation stopped

02:15

Noci now

P1 / SEV-2: Error rate above 2% on checkout-api

Payments escalation · level 1

Working theory: ledger-writer v2.31.0 holds database connections longer, and checkout requests queue behind the pool.

Hermes · Noci On call

P1 / SEV-2 · Error rate above 2% on checkout-api

  1. Hermes Hi Priya, this is Hermes from Noci.
  2. Incident 2318 — checkout-api is sev‑2.
  3. Looks like the ledger-writer deploy is holding database connections. Want the full investigation, or should I open a war room and get the team on it?
  4. Priya Open the war room. I've got it.
  5. Hermes The war room is open and I'll keep it updated. Your acknowledgement is recorded and the escalation is stopped.
  6. By the way, Marco Diaz handled a near-identical incident recently — want me to bring him in too?
Illustrative example: Northwind Payments and its people are fictional.

How Noci works

During an incident, Noci's AI voice agent phones the on-call engineer, briefs them on the incident and takes actions during the call. The transcript, the outcome and an AI summary land on the incident timeline. On-call schedules, escalation policies and incidents share one product, and you choose, step by step, whether an agent asks before it acts.

Illustrative example: Northwind Payments and its people are fictional.

The Context Lake

  • Alerts, deploys, tickets, chat, meetings and ownership, in one place.
  • An impact graph built around your business flows.
  • Customer impact from billing and CRM. Coming
Production Context Lake Impact graph
Production Context Lake: impact graph Impact graph. 8 kinds of signal flow into the Production Context Lake: monitoring, tickets, customers (Billing and CRM, coming), code changes, deploys, chat, ownership and calendars. The Lake joins each signal to the services it concerns: checkout-api, payments-gateway, ledger-writer, fraud-scoring and settlement-batch. Each service feeds the business flows that depend on it (checkout, refunds and payouts), and each flow ends in the teams accountable for it and the customers who use it; customer impact is coming. In this example, ledger-writer v2.31.0 deployed at 02:06 and the checkout flow is impacted: the branch through checkout-api, payments-gateway and ledger-writer to checkout, its merchants and the Payments team is highlighted. Signals Context Lake Services Business flows Teams and customers Monitoring Alerts and metrics Tickets Support queue Customers Billing and CRM Code changes Pull requests Deploys Release pipeline Chat Team channels Ownership Rosters and teams Calendars Meetings and freezes checkout-api Payments payments-gateway Payments ledger-writer Ledger Ledger · changed 02:06 fraud-scoring Risk settlement-batch Ledger Checkout Healthy INC-2318 · SEV-2 Refunds Healthy Payouts Healthy Enterprise merchants Coming Marketplace sellers Coming Payments team Owns checkout-api Paged: Priya Raman Risk team Owns fraud-scoring Ledger team Owns ledger-writer
  • Healthy flow
  • Impacted branch
  • Coming
Illustrative example: Northwind Payments and its people are fictional.

Fewer blind spots, so customers don't page you before Noci does

  • Finds services and resources that no alert covers.
  • Proposes the alert that would cover each one.
  • You choose which steps ask you first.
Coverage Casey
  • checkout-api Payments Watched
  • payments-gateway Payments Watched
  • ledger-writer Ledger Watched
  • fraud-scoring Risk Unwatched No monitor on p99 latency
  • card-auth Risk Watched
  • settlement-batch Ledger Changed, unwatched New payout queue shipped Tuesday, no alert on its depth
  • merchant-portal Web Watched
  • notifications-worker Platform Watched
  • Proposed by Casey p99 latency above 800ms on fraud-scoring Datadog · APM · high
  • Proposed by Casey Payout queue depth above 5,000 on settlement-batch CloudWatch · Metric · critical

Less noise, every week

  • Every alert scored on four layers.
  • Flaky alerts suppressed, each with its reason.
  • The pages that remain are the ones that matter.
Flakiness Scored on every alert
Alert RecurrenceSeasonalityResolutionAnomaly Verdict
Disk usage above 85% on settlement-batch Datadog 91% · Highly flaky Suppressed: Clears on its own in under 3 minutes
Error rate above 2% on checkout-api Datadog 4% · Signal-rich Kept: correlated into INC-2318
CPU steal above 10% on node pool b Alertmanager 86% · Highly flaky Suppressed: Fires every night around 02:00
Pod restarts on notifications-worker Alertmanager 83% · Highly flaky Suppressed: Fired 38 times in the last 7 days
Connection pool wait above 500ms on ledger-writer CloudWatch 6% · Signal-rich Kept: correlated into INC-2318

When something breaks: triage first, then page

  • Correlated with everything firing and the deploy window.
  • The owner paged with what broke, changed, and to try.
  • Hermes calls the owner and briefs them from live facts.
Page Slack · Teams · phone

P1 / SEV-2 Error rate above 2% on checkout-api

Service · Team
checkout-api · Payments
Source
Datadog · webhook
Escalation
Payments escalation · level 1
Paging
Priya Raman (primary)

Working theory · Soren · 82%

ledger-writer v2.31.0 holds database connections longer, and checkout requests queue behind the pool.

Recommended Roll back ledger-writer to v2.30.4. Rollbacks are set to ask first, so it waits for you.

Call · Hermes to Priya Raman Transcript
  1. 00:00 Hermes Hi Priya, this is Hermes from Noci.
  2. 00:02 Hermes Incident 2318 — checkout-api is sev‑2.
  3. 00:05 Hermes You're being paged as the primary on-call under the Payments escalation policy.
  4. 00:09 Hermes Looks like the ledger-writer deploy is holding database connections. Want the full investigation, or should I open a war room and get the team on it?
  5. 00:17 Priya Open the war room. I've got it.
  6. 00:19 Hermes The war room is open and I'll keep it updated. Your acknowledgement is recorded and the escalation is stopped.
  7. 00:25 Hermes By the way, Marco Diaz handled a near-identical incident recently — want me to bring him in too?
  8. 00:31 Priya Yes, bring him in.
  9. 00:32 Hermes Bringing Marco in alongside you now.
  • open_war_room War room opened: #inc-2318-checkout-api
  • continue_investigation Investigation continues: Soren keeps working the theory
  • acknowledge Acknowledged: Priya Raman · escalation stopped
  • page_person Bringing in Marco Diaz: Best fit from the Context Lake

The whole lifecycle

  • Runs the bridge in Slack, Teams, Zoom or Meet.
  • Drafts status updates for a person to post.
  • Assembles the postmortem. Coming
INC-2318 Checkout errors after ledger-writer deploy
  1. Alert fired Error rate above 2% on checkout-api
  2. Correlated 3 alerts and 1 deploy, one incident
  3. Paged the owner Hermes calls Priya Raman
  4. Bridge opened #inc-2318-checkout-api, running summary on
  5. Right people in Marco Diaz joins
  1. Triggered
  2. Investigating
  1. Status update drafted Priya reviews and posts it
  2. Rollback approved ledger-writer back to v2.30.4
  3. Resolved Summary closed in the war room
  4. Post-incident review Agenda and timeline prepared
  5. Postmortem assembled From the incident record, in review
  1. Identified
  2. Monitoring
  3. Resolved

What it learned goes into the next playbook.

One platform, the whole incident

Paging & incident tools AI SRE agents Observability platforms Noci
Triage before anyone is paged Paging & incident tools Partial AI SRE agents Observability platforms Partial Noci Yes
Noise suppressed, with the reason shown Paging & incident tools Partial AI SRE agents Observability platforms Partial Noci Yes
Blind spots found and alerts proposed Paging & incident tools AI SRE agents Observability platforms Partial Noci Yes
Technical and business signals in one context Paging & incident tools AI SRE agents Partial Observability platforms Partial Noci Yes
AI incident call to the on-call engineer Paging & incident tools AI SRE agents Observability platforms Noci Yes
Runs the bridge, summary and status drafts Paging & incident tools Partial AI SRE agents Observability platforms Noci Yes
Pre-incident ceremonies: triage and rules before escalation Paging & incident tools Partial AI SRE agents Observability platforms Noci Yes
On-call schedules and escalation Paging & incident tools AI SRE agents Observability platforms Partial Noci Yes
Customer impact from billing and CRM Paging & incident tools Partial AI SRE agents Observability platforms Noci Coming

Typical capabilities by category; individual products vary.

Early access

Join the next onboarding batch

  • A person replies within 1 business day.

Request Work email only