Keep is a free, open source monitoring & observability project written in Python and released under a custom open-source licence. It has 12,474 GitHub stars, 1,542 forks and 609 open issues, and was last pushed 11 hours ago. On this registry it ranks #36 of 270 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 107 stars over the last 30 tracked days.

Keep — Unify, automate, and elevate your monitoring workflow

What is Keep?

Keep is the open-source AIOps and alert management platform: a Python-based single pane of glass that unifies alerts and incidents, deduplicates and enriches them, and automates response through declarative YAML workflows, aimed at the SRE, platform and on-call teams that operate many monitoring tools at once.

What it is

Keep describes itself as the open-source AIOps and alert management platform, and it sits in the Infrastructure & Operations / Monitoring & Observability category. It is written in Python and presents a single pane of glass: one customizable UI for every alert and incident, backed by bi-directional integrations with monitoring tools and a declarative workflow engine that the README calls "GitHub Actions for your monitoring tools."

The problem it solves is alert sprawl. Each observability tool has its own interface, severity vocabulary and deduplication rules, so responders triage the same incident in several places. Keep replaces that with centralised deduplication, correlation, filtering and enrichment, then acts on the result by creating tickets, sending notifications or restarting servers. An AIOps 2.0 layer adds AI-powered correlation and summarisation.

Key capabilities

  • Single pane of glass: one customizable UI covering all alerts and incidents.
  • Alert handling: deduplication, correlation, filtering and enrichment in one place.
  • Bi-directional integrations with observability tools including Datadog, Dynatrace, Grafana, Prometheus, Sentry, Splunk, Zabbix, New Relic and CloudWatch.
  • Declarative YAML workflows built from triggers (alert, incident, schedule, manual), steps that read or fetch data, and actions that update tickets, send notifications or restart servers.
  • AIOps 2.0 with selectable AI backends: Anthropic, OpenAI, DeepSeek, Ollama, LlamaCPP, Grok and Gemini.
  • Incident and ticketing integrations covering PagerDuty, OpsGenie, Incident.io, Jira, Linear, ServiceNow, GitHub, GitLab and Monday.
  • Enrichment via Bash, Python, SSH, Webhook and QuickChart, with Airflow orchestration, Amazon SQS or Kafka queues, and storage on BigQuery, ClickHouse, MongoDB, MySQL, PostgreSQL or Snowflake.

Who uses it and how

  • SRE and platform teams consolidating alerts from many observability tools into one UI and one triage queue.
  • On-call groups routing alerts to Slack, Teams, Telegram, Mattermost, SMTP, SendGrid, Twilio, Pushover or Ntfy.sh.
  • Kubernetes, OpenShift, GKE or AKS operators using ArgoCD or Flux who want alert automation wired into cluster tooling.
  • The README example workflow creates a Jira ticket for every critical Sentry alert on the payments or ftp services, and Slacks the payments team when the affected service is payments.
  • Organisations needing private AI enrichment can point AIOps at Ollama or LlamaCPP instead of a hosted model.

Getting started

The README excerpt here does not name a package, Docker image or compose file; it directs readers to installation documentation at docs.keephq.dev, a "Try it out" link, the website at keephq.dev, and a demo booking for the hosted path.

How it compares

No list of paid products that Keep replaces is given, and no peer tools are named in the facts. It therefore stands alone in this registry as the AIOps and alert management platform described here, and comparisons with commercial incident-management suites are not supported by the material supplied.

When to use it — and when not to

A self-hoster must run the backing services: a database such as PostgreSQL, MySQL, MongoDB, ClickHouse or a warehouse, queues if used, and credentials for every connected communication and ticketing provider. The reported licence is NOASSERTION, so terms should be reviewed before adoption, and the repository carries 609 open issues. Teams unwilling to run data infrastructure or wire up many third-party providers should look elsewhere.

project readme (upstream, from github) — read inline

The open-source AIOps and alert management platform


Single pane of glass, alert deduplication, enrichment, filtering and correlation, bi-directional integrations, workflows, dashboards.

PRs Welcome Join Slack GitHub commit activity

Docs · Try it out · Report Bug · Book a Demo · Website

  • 🔍 Single pane of glass - Best-in-class customizable UI for all your alerts and incidents
  • 🛠️ Swiss Army Knife for alerts - Deduplication, correlation, filtering and enrichment
  • 🔄 Deep integrations - Bi-directional syncs with monitoring tools, customizable workflows
  • ⚡ Automation - GitHub Actions for your monitoring tools
  • 🤖 AIOps 2.0 - AI-powered correlation and summarization

See full platform documentation.


Supported Integrations

View the full list in our documentation

Missing a provider? Submit a new provider request and we'll add it quickly!

AI Backends for Enrichments, Correlations and Incident Context Gathering

Observability Tools

Databases & Data Warehouses

Communication Platforms

Incident Management

Ticketing Tools

Container Orchestration Platforms

Data Enrichment

Workflow Orchestration

Queues

Workflows

Keep is GitHub Actions for your monitoring tools.

A Keep Workflow is a declarative YAML file that automates your alert and incident management. Each workflow consists of:

  • Triggers - What starts the workflow (alerts, incidents, schedule or manual)
  • Steps - Read or fetch data (enrichment, context)
  • Actions - Execute operations (update tickets, send notifications, restart servers)

Here's a simple workflow that creates a Jira ticket for every critical alert from sentry for payments and api services.

For more workflows, see here.

workflow:
  id: sentry-alerts
  description: create ticket alerts for critical alerts from sentry
  triggers:
    - type: alert
      # customize the filter to run only on critical alert from sentry
      filters:
        - key: source
          value: sentry
        - key: severity
          value: critical
        # regex to match specific services
        - key: service
          value: r"(payments|ftp)"
  actions:
    - name: send-slack-message-team-payments
      # if the alert is on the payments service, slack the payments team
      if: "'{{ alert.service }}' == 'payments'"
      provider:
        type: slack
        # control which Slack configuration you want to use
        config: " {{ providers.team-payments-slack }} "
        # customize the alert message with context from {{ alert }} or any other {{ step }}
        with:
          message: |
            "A new alert from Sentry: Alert: {{ alert.name }} - {{ alert.description }}
            {{ alert}}"
    - name: create-jira-ticket-oncall-board
      # control the workflow flow with "if" and "foreach" statements
      if: "'{{ alert.service }}' == 'ftp' and not '{{ alert.ticket_id }}'"
      provider:
        type: jira
        config: " {{ providers.jira }} "
        with:
          board_name: "Oncall Board"
          custom_fields:
            customfield_10201: "Critical"
          issuetype: "Task"
          # customize the summary
          summary: "{{ alert.name }} - {{ alert.description }} (created by Keep)"
          description: |
            "This ticket was created by Keep.
            Please check the alert details below:
            {code:json} {{ alert }} {code}"
          # enrich the alerts with more context. from now on, the alert will be assigned with the ticket id, type and url
          enrich_alert:
            - key: ticket_type
              value: jira
            - key: ticket_id
              value: results.issue.key
            - key: ticket_url
              value: results.ticket_url

Enterprise Ready

  • Developer First - Modern REST APIs, native SDKs, and comprehensive documentation for seamless integration
  • Enterprise Security - Full authentication support (SSO, SAML, OIDC, LDAP) with granular access control (RBAC, ABAC) and team management
  • Flexible Deployment - Deploy on-premises or in air-gapped environments with cloud-agnostic architecture
  • Production Scale - High availability, performance-tested infrastructure supporting horizontal scaling for enterprise workloads

Getting Started

Need help? Can't find your environment listed? Reach out on Slack and we'll help you quickly.

Keep can run in various environments and configurations. The easiest way to start is with Keep's Docker Compose.

🫵 Keepers

Top Contributors

A special thanks to our top contributors who help us make Keep great. You are more than awesome!

Want to become a top contributor? Join our Slack and DM Tal, Shahar, or Furkan.

Contributors

Thank you for contributing and continuously making Keep better, you're awesome 🫶

Frequently asked questions

Is Keep free to use?

Keep is open source. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Keep do?

Unify, automate, and elevate your monitoring workflow

What is Keep written in?

Keep is primarily written in Python. Its source is publicly available at https://github.com/keephq/keep, and it has 12,474 GitHub stars.