Written by: Nimesh Chakravarthi, Co-founder & CTO, Struct
Key Takeaways
-
Rootly excels at coordination but leaves a 30-45 minute manual investigation gap that inflates MTTR across tools like Datadog and Sentry.
-
Struct delivers AI-powered root-cause analysis in under five minutes by automatically correlating logs, traces, metrics, and code changes.
-
Mapping Struct investigations to Rootly severity tiers ensures responders receive a complete report the moment they join an incident channel.
-
Bi-directional Jira sync and automated status updates turn Rootly tickets into full post-incident artifacts without manual copy-paste.
-
Struct layered on Rootly converts coordination into a complete end-to-end automated response loop for your on-call runbook.
Designing Rootly Severity-Specific Workflows with Struct
Rootly’s severity-based triggers determine which playbook fires, who gets paged, and what Slack channels open. However, most configurations lack a critical component: an automated investigation action that runs in parallel with these coordination steps. Without this parallel investigation, responders join the incident channel and must start their diagnostic work from scratch. Mapping a Struct investigation rule to each severity tier solves this gap by ensuring a root-cause report is already waiting when responders arrive.
The table below shows how to pair each Rootly severity tier with the appropriate Struct investigation depth so responders receive actionable root-cause data as soon as they enter the incident channel. Configure Rootly triggers first, then attach the corresponding Struct rule to the same severity field.
|
Alert Severity |
Rootly Trigger |
Struct Automated Investigation Action |
Expected Output Time |
|---|---|---|---|
|
SEV-1 (Critical) |
Immediate page + war-room channel creation |
Full stack investigation: logs, traces, code diff, blast-radius summary |
< 5 minutes |
|
SEV-2 (High) |
On-call page + incident Slack thread |
Targeted log correlation + anomaly timeline posted to thread |
< 5 minutes |
|
SEV-3 (Medium) |
Slack notification, no immediate page |
Lightweight triage: error rate delta + top exception summary |
< 5 minutes |
|
SEV-4 (Low) |
Ticket creation only |
Async investigation report attached to Jira ticket |
< 10 minutes |
Turning Rootly Jira Tickets into Full Incident Records
Rootly’s native Jira integration creates tickets from incidents and can push status updates back to the incident record. The practical limitation is that the Jira ticket typically contains only coordination metadata, such as who is on call, what the severity is, and when it was acknowledged. It rarely contains investigation evidence.
When Struct completes an automated investigation, it outputs a structured report that includes root cause, correlated log excerpts, impacted services, and a suggested fix. Routing that report into the linked Jira ticket, either via Rootly’s webhook or Struct’s direct Jira integration, turns the ticket into a complete post-incident artifact without any manual copy-paste. Engineers reviewing the ticket in a post-mortem have the full evidence chain. Product managers tracking SLA compliance have the blast-radius summary. The bi-directional sync then allows status changes in Jira, such as “Root Cause Identified”, to update the Rootly incident record, which keeps both systems consistent without duplicate effort.
Feeding Investigation Results into Rootly Status Updates
Rootly’s status-page and stakeholder-update automations work best when they carry investigation content, not just coordination status. A status update that reads “Investigating — engineers engaged” provides less value than one that reads “Investigating — elevated error rate on payment-service traced to a bad deploy at 14:32 UTC, rollback in progress.”
Struct’s impact summary, generated within minutes of alert fire, can be injected into Rootly’s automated status update template via webhook. Stakeholder communications then reflect actual investigation findings rather than generic placeholders. This reduces inbound “what’s happening?” Slack messages to the on-call team and frees responders to focus on resolution rather than communication.
Integrate AI Investigation with Rootly: Six-Step Playbook
This six-step sequence assumes Rootly is already configured with at least one active severity workflow and that the engineering team uses Slack as the primary incident channel.
Step 1 — Connect Rootly Slack Channel to Struct. Goal: give Struct a clear trigger source for new incidents. Owner: SRE lead. Input: Rootly incident Slack channel name. Output: Struct monitors the channel for new incident threads and starts investigations when they appear. Trade-off: Struct listens to all messages in the channel, so scope it to incident-creation bot messages only to reduce noise.
Step 2 — Map Incident Fields. Goal: pass severity, service name, and alert body to Struct in a structured format. Owner: SRE lead. Input: Rootly incident payload schema. Output: Struct receives structured metadata alongside the raw alert, which improves correlation quality. Trade-off: custom field names in Rootly require a one-time mapping configuration in Struct.
Step 3 — Configure Severity-Based Investigation Rules. Goal: match the severity-automation table above so that each Rootly severity tier triggers the appropriate Struct investigation depth. Owner: SRE lead or on-call engineer. Input: severity tiers defined in Rootly. Output: Struct runs the appropriate investigation depth per tier automatically. Trade-off: over-configuring SEV-3 and SEV-4 rules can generate investigation volume that exceeds the monthly plan limit on lower tiers, so start with SEV-1 and SEV-2 rules only and expand coverage once you have validated the investigation quality.
Step 4 — Set Up Bi-Directional Jira Sync. Goal: route Struct’s investigation report into the linked Jira ticket and keep statuses aligned. Owner: engineering manager. Input: Jira project key and Rootly–Jira webhook. Output: every Struct report appends to the corresponding Jira issue, and Jira status changes reflect back in Rootly. Trade-off: this step requires Jira admin access to configure the inbound webhook.
Step 5 — Enable Conversational Slack Bot. Goal: allow responders to query Struct mid-incident without leaving Slack. Owner: on-call engineer. Input: Struct bot added to the incident channel. Output: engineers tag Struct to pull additional logs, test hypotheses, or verify user impact interactively. Trade-off: junior engineers may over-rely on conversational queries instead of reviewing the initial report first.
Step 6 — Route Resolved Root Causes to Code Agent or PR Creation. Goal: close the loop from alert to fix with minimal handoff friction. Owner: on-call engineer. Input: confirmed root cause from Struct dashboard. Output: Struct hands off context to a coding agent or generates a pull request directly. Trade-off: automated PR creation requires GitHub write access and a review gate to prevent unreviewed merges.
Walk through this six-step setup in a live 10-minute demo to see how Struct automates your investigation workflow.
Rootly MTTR Reduction Strategies with Struct
MTTR is the sum of detection time, triage time, and resolution time. Rootly’s automation compresses detection time by paging faster and resolution time by coordinating responders. Triage time, the 30-to-45-minute window of manual investigation, remains largely untouched by coordination tooling alone.
Large-scale Struct customers report an 80% reduction in triage time, for example, compressing a typical 45-minute investigation to under 5 minutes. Struct can help recover substantial engineer time monthly from triage alone, which returns hours to product development.
A practical 30-day review cadence keeps these gains measurable. In week one, establish baseline MTTA and MTTR from Rootly’s incident analytics. In weeks two and three, run Struct on all SEV-1 and SEV-2 incidents and log investigation completion time per event. In week four, compare triage duration before and after, and adjust severity rules where Struct’s investigation depth is mismatched to the alert type. U.S. teams operating under HIPAA or SOC 2 audit requirements should document this cadence as part of their incident response procedure (see FAQ for compliance details).
Rootly Event-Driven Automations in Existing Stacks
Achieving these MTTR reductions depends on how well the Rootly-plus-Struct workflow integrates with your existing observability stack. The combined workflow fits into existing observability stacks without requiring a platform migration. Struct integrates with Datadog, Sentry, AWS CloudWatch, GCP Logs, Azure Logs, Grafana, Prometheus, Loki, Sumo Logic, and Better Stack on the observability side, and with GitHub for code context. Rootly continues to own coordination, and Struct owns investigation, so neither system needs to replace the other.
Three common pitfalls degrade the quality of event-driven automations in this setup, each representing a different form of insufficient signal: missing data, over-specified data, or unused institutional knowledge. First, incomplete telemetry: if services lack structured logging or trace IDs, Struct’s correlation engine has less signal to work with. The fix is to enforce trace ID propagation and structured log formats before enabling auto-investigations on those services. Second, over-customization: teams that write highly specific runbook instructions for every alert type spend more time maintaining Struct configurations than they save. This creates a different signal problem, with too much noise in the configuration layer. Start with general runbook ingestion and add specificity only where investigation accuracy is measurably low. Third, lack of runbook ingestion: Struct can ingest existing on-call runbooks directly, encoding institutional knowledge that would otherwise live only in senior engineers’ heads. This is the inverse of the over-customization problem, where teams have valuable signal but are not feeding it to the system. Teams that skip this step get generic investigations, while teams that complete it get investigations that mirror how their best SRE would approach the problem.
Frequently Asked Questions
Is Struct secure enough for teams with HIPAA or SOC 2 requirements?
Struct is fully SOC 2 and HIPAA compliant. Logs are accessed and processed ephemerally, and they are not stored after the investigation completes. For the majority of Seed-to-Series C companies operating under these compliance frameworks, Struct meets the standard without additional configuration.
How long does it take to set up Struct alongside Rootly?
The initial setup of Rootly takes about 15 minutes. The integration playbook described above, including Jira sync and severity rule configuration, can be completed by one SRE.
What happens if our logging and telemetry are incomplete?
Struct’s investigation quality is proportional to the telemetry available. Teams already using Sentry, Datadog or cloud logs, and Slack for alerting get the highest investigation accuracy. If structured logging or trace IDs are absent for a given service, Struct will surface what it can but will note the data gap in the investigation report, which itself is a useful signal for improving observability coverage.
Can we customize how Struct investigates our specific alert types?
Yes. Teams can paste their existing on-call runbooks directly into Struct, define custom correlation ID formats, and configure composable widgets that guarantee specific data visualizations appear for certain alert categories. The AI follows the runbook logic when an alert fires and replicates the investigation approach of a senior engineer familiar with the system.
Conclusion: Turning Rootly into a Full Response Loop
Rootly is a strong coordination platform, but it does not eliminate the manual investigation window that consumes the majority of MTTR. Struct fills that gap by delivering zero-click root-cause context before responders engage, automatically correlating logs, traces, and code the moment an alert fires. The six-step integration playbook above converts Rootly from a coordination tool into a complete automated response loop. Alert fires, Rootly pages, Struct investigates, the responder reviews a five-minute report instead of hunting for 45 minutes, and the fix ships.
Setup is fast, and you can see the FAQ for timing details. The platform is SOC 2 and HIPAA compliant. The 30-day pilot is risk-free.
Run your first automated investigation today and see how Struct compresses triage time from 45 minutes to under 5.
