Evally
Start free
Support & ops

Alert & log triage

Page on-call for what matters, open tickets for the rest, and ignore the noise.

Classifies each alert or batch of log lines by severity and area, checks whether a person actually needs to act, and flags anything that smells like a security incident. Put it in front of your pager and in front of expensive LLM root-cause analysis.

Use this judgeCustomize it

Try it live

Real calls to Jev. Pick an example or paste your own.

Examples
197
8
No verdict yet

Pick an example or paste your own input, then run it.

Under the hood

Every question and rule, in the open. Fork it to change any of them.

What it asks

Reads alert and service, then asks 4 questions in one call.

  1. Q1SeverityPick one

    How severe is the alert?

    CriticalHighMediumLow
  2. Q2Needs a personYes / no

    Does an operator need to act on the alert? (Answer no for retries that succeeded, expected warnings and noise.)

  3. Q3Security signalYes / no

    Does the alert suggest a security issue (unauthorized access, exposed credentials, unusual use of privileges, or known attack patterns)?

  4. Q4AreaPick one

    Which area is affected?

    InfrastructureDatabaseApplicationNetworkSecurityThird partyUnknown

How it decides

Rules run in code, top to bottom. The first one that matches gives the verdict.

  1. 1
    If Security signal ≥ 0.7Page on-call
  2. 2
    If Severity is CriticalPage on-call
  3. 3
    If Severity is High and Needs a person ≥ 0.6Open a ticket
  4. 4
    If Needs a person < 0.3Ignore
  5. 5
    If Severity is LowIgnore
  6. ·
    DefaultOpen a ticket

Call it from your code

Every template runs as-is with an API key, no setup: POST /api/v1/judges/alert-triage/run.

curl -X POST https://tryevally.com/api/v1/judges/alert-triage/run \  -H "Authorization: Bearer $EVALLY_API_KEY" \  -H "Content-Type: application/json" \  -d '{  "input": {    "alert": "ERROR 2026-09-24T10:14:03Z api-gateway: upstream connect error or disconnect/reset before headers (503) x 4,812 in 60s\nERROR payments-svc: connection pool exhausted (max=50), waiting requests=1,204",    "service": "Checkout"  }}'

Seen in the wild

Community builds on Jev that use this pattern. Not affiliated with Evally.

More in Support & ops