Skip to main content
What you’ll get: By the time your on-call engineer opens their laptop, ewake has already investigated the alert, probable cause ranked by confidence, supporting evidence assembled, next steps ready. The work that takes 30 minutes manually happens in seconds, automatically.

What it does

The On-Call Agent monitors a configured Slack channel for alerts from your observability tools (Datadog, Grafana, etc.). When an alert fires, ewake immediately queries your connected sources, metrics, logs, recent deployments, past incidents, and posts a structured investigation response in the alert thread. Your on-call engineer arrives to a Slack thread that already contains:
  • The probable root cause, ranked by confidence
  • Supporting evidence (relevant logs, metrics, recent commits)
  • Suggested next steps
No manual log queries. No dashboard clicking. The context is already there.

When to use it

  • You have alerts routing to a Slack channel (#alerts, #incidents, #monitoring)
  • Your team is on-call and needs faster first-response context
  • You want to reduce the time between alert firing and understanding what’s happening

What you’ll get

A typical ewake response in a Slack alert thread includes:
  • Summary, one-line description of what happened
  • Probable cause, top hypothesis with confidence indicator
  • Evidence, log excerpts, metric spikes, recent deploys that correlate
  • Suggested next steps, concrete actions to investigate or resolve

Prerequisites

Before setting up the On-Call Agent, make sure these integrations are connected:

Slack

Alert source

Datadog, Grafana, or another connected observability tool

Source control

GitHub or GitLab
For the strongest alert investigation context, also connect:

Incident.io

Lets ewake reference past incidents and postmortems, surface patterns like “this looks like incident #47 from last month.”

Deployment Tracking

Sends deployment events to ewake so it can immediately correlate an alert with a recent deploy.

How to set it up

1

Add ewake to your alerting channel

Ewake only reads channels it’s been invited to. Before creating a trigger, invite @ewake to the Slack channel where your alerts land (e.g. #alerts, #incidents, #monitoring).Follow Add Ewake to a channel if you haven’t done this yet.
2

Go to Alert Response

In your ewake dashboard, click Alert Response in the sidebar, that is where On-Call Agent triggers live.
3

Start from a template, or from scratch

Click Templates to start from a ready-made trigger, then adjust it. Each one pre-fills the name and prompt; you still pick your own channel and bot.To start from nothing instead, click New trigger.
On-Call Agent trigger setup in ewake
4

Name your trigger

In Trigger Name, enter a name that identifies this trigger (e.g. datadog-alerts-prod, pagerduty-critical).
5

Select a Slack channel

In Slack Channel, choose the same channel you invited ewake to in the first step, for example:
  • #alerts
  • #incidents
  • #monitoring
6

Select the alert bot

In Slack Bot, choose which bot ewake should listen to (e.g. Datadog). This ensures ewake only responds to real alerts, not other messages in the channel.
7

Write the initial prompt

Initial Prompt is the message sent to the On-Call Agent when the trigger fires. This is the main lever to customise tone and depth.Examples:
8

Create the trigger

Leave Active on, then click Create.
The On-Call Agent is live. The next time an alert fires in the selected channel, ewake will automatically respond in the thread.
Switch Active off on a trigger to pause it without deleting it, useful during a planned maintenance window.

Actions

Everything above is read-only: ewake investigates and reports. Actions let a trigger do something afterwards. In the Action field, describe the follow-up in plain words, for example:
Click Parse action to see the exact tool calls your wording becomes, along with any tools it needs whose integration isn’t connected. Review that list before saving, it’s the whole point of the step. Each parsed action can carry a delay (up to 24 hours) and can optionally post to Slack when it runs.
Actions are the one place ewake writes outside itself. They only ever do what you typed, they only use integrations you’ve connected, and they’re bounded by the access those credentials already grant. Ewake still cannot restart a service, change a monitor, or push code.
Actions are a gated feature. If the Action field doesn’t appear on your trigger form, it isn’t enabled for your workspace, contact support@ewake.ai.

How Actions fit the security model →


Need help setting this up? Contact support@ewake.ai.