Know why it broke before the bridge call starts.

Relay reads the incident ticket, investigates your AWS and Azure environments read-only, and posts the root cause with the evidence behind every claim.

Drag to turn the map. Hover a service.

Case CASE-7F2AExample incident, replayed

What brokeWhat Relay did

Runs on Amazon Bedrock AgentCore in your own AWS account, with 5 specialist agents, 50 read-only tools and 4 MCP integrations. Works with Azure and DevRev.

Amazon Bedrock AgentCore
AWS DevOps Agent
Amazon CloudWatch
AWS CloudTrail
Amazon DynamoDB
Amazon Cognito

The first hour of an incident, handed back.

The same four steps happen either way. With Relay they are already done when you open the ticket.

On call, without Relay

The page goes off. You open the ticket and work out whose environment it is.
You sign in to the right account and region, then open CloudWatch, the logs and the load balancer.
You ask in the channel who deployed what, and scroll through CloudTrail.
You form a theory, look for what would disprove it, and write it up for the ticket.

With Relay

Relay matches the ticket to the customer's environment, or asks one clear question.
It reads alarms, metrics, logs and recent changes, read-only, while you get to a laptop.
It checks the cause against the evidence, and looks for what would disprove it.
You open the ticket to the cause and its evidence, and decide what to do.

Every claim comes with its evidence.

Relay's report is short enough to read on a phone, and every sentence in it points at the tool result that proves it. Select a sentence to see what it rests on.

Root cause

High confidence

UpdateService at 14:02:11AWS CloudTrail[1]

{
  "eventName": "UpdateService",
  "userIdentity": "deploy-pipeline",
  "requestParameters": {
    "service": "checkout",
    "desiredCount": 0
  }
}

Service events, checkoutAmazon ECS[2]

14:02:40 stopped 3 running tasks
14:03:02 stopped 3 running tasks
14:03:05 service has 0 running tasks

Healthy targets, checkoutAmazon CloudWatch[3]

Load balancer 5XX errorsAmazon CloudWatch[4]

It reads what you would read, only faster.

The checks an engineer runs by hand, as allow-listed, read-only tools. Switch clouds to see each one.

14 read-only checks in AWS, all allow-listed.

Alarms and metrics

What fired, and what the numbers did around it.

Checking CloudWatch alarms
Finding metrics
Reading metrics

Logs

Queries over the log groups and workspaces that matter.

Finding log groups
Querying logs

Changes and deployments

Who changed what, and what shipped, just before it broke.

Looking for recent changes in CloudTrail
Checking recent deployments

Resources and health

The state of the things involved, and the provider's own health signals.

Checking EC2 instances
Checking load balancer targets
Checking AWS Health
Reading AWS resources

Runbooks and documentation

The provider's troubleshooting guides, read as needed.

Searching AWS documentation
Reading AWS documentation
Reading an AWS troubleshooting guide

When it gets deep

AWS DevOps Agent takes over, with your approval, when Relay's own investigation is inconclusive.

From ticket to report, the same way every time.

The flow runs on its own for every ticket. Watch each step live, or come back to the finished report.

01
A ticket arrives
From DevRev or the console. Relay opens a case and starts the run in the cloud, while the ticket is still fresh.
02
Relay finds where to look
It matches the ticket to the customer's environment, and asks one clear question when it cannot tell.
03
Specialists investigate
Read-only agents check alarms, metrics, logs and recent changes in AWS or Azure, and stream every call to the console.
04
You get the root cause
A report with the cause, its confidence and the evidence behind each claim, posted back to the ticket.

Built for the engineers who own the pager.

Relay does the first hour of an investigation and leaves the decisions to your team.

Grounded, not guessed: Every claim cites a tool result. A second pass looks for evidence against the cause before the report goes out.
AWS and Azure in one flow: The same intake, routing and report for both clouds, with each case pinned to the environment it belongs to.
Managed agents when it gets deep: AWS DevOps Agent and Azure SRE Agent take over when Relay's own investigation is inconclusive, with your approval.
People stay in charge: Anything that would change production goes to an on-call approver first. Their reply resumes the run.
Every step is visible: Each tool call streams to the console as it happens, from the first check to the final report.
Quality you can measure: Engineers rate each report against the real cause, so accuracy, time and cost are tracked for every agent.

Relay reads. It never changes your accounts.

Access is scoped to one environment per case, every action leaves a record, and it all runs in your own AWS account.

Read-only by design
Agents use read-only roles and allow-listed tools. Nothing they call can change a customer's account.
No standing credentials
Relay assumes a role each customer deploys, per case. Secrets stay in AWS Secrets Manager.
Everything is audited
Every sign-in, change and agent action is recorded, and archived with S3 Object Lock.
Enterprise sign-in
Amazon Cognito with multi-factor authentication, Microsoft sign-in and role-based access.

Questions, answered.

Short answers to what security reviews and on-call leads ask first.

Can Relay change anything in a customer's account?

No. In AWS it assumes a role the customer deploys with a CloudFormation template, built on AWS's ViewOnlyAccess. In Azure it holds the Reader role. Its tools are allow-listed, and anything that would change production goes to an on-call approver instead.

Where does Relay run, and where does the data live?

In your own AWS account: the agents run on Amazon Bedrock AgentCore, cases and runs are kept in DynamoDB, and the audit trail is archived in S3 with Object Lock.

Which models does it use?

Claude models on Amazon Bedrock. An admin picks the default, and can give each stage of an investigation its own model.

How do tickets reach Relay?

A DevRev webhook opens a case for every new ticket, and Relay posts its findings back to the ticket. Engineers can also open a case from the console.

What happens when Relay cannot find the cause?

It says so, with what it checked and what it ruled out. It can hand over to AWS DevOps Agent or Azure SRE Agent, with an engineer's approval.

How do we know the reports are right?

Every claim cites a tool result, so you can check it in one click. Engineers rate each report against the real cause, and accuracy is tracked per agent.

Give your next incident a head start.