Written by: Nimesh Chakravarthi, Co-founder & CTO, Struct
Key Takeaways for PagerDuty AI and Struct
-
PagerDuty AI excels at alert suppression, correlation, and triage but leaves deep cross-tool log investigation to engineers, which creates a persistent manual gap.
-
Configuring PagerDuty AIOps across six steps—event orchestration, noise filtering, dynamic triage, auto-remediation, Slack integration, and post-incident reviews—reduces alert fatigue but still requires manual root-cause hunting.
-
Clear escalation thresholds and decision frameworks help teams decide when to trust automation versus when to escalate, which prevents both alert fatigue and missed incidents.
-
Struct integrates directly with PagerDuty and Slack to investigate alerts automatically across Datadog, CloudWatch, Sentry, and GitHub, then delivers root-cause dashboards before engineers open their laptops.
-
Struct automates your on-call runbook to close the PagerDuty investigation gap in minutes and gives junior engineers a reliable starting point on every incident.
PagerDuty AIOps Quickstart: 6-Step Configuration Guide
Step 1 — Configure Event Orchestration Rules
In PagerDuty, go to AIOps → Event Orchestration and define routing rules that map incoming alert payloads to services by matching fields such as source, component, severity, and region. Set suppression conditions for known maintenance windows or expected deployment events. PagerDuty AIOps then automates repetitive tasks and workflows based on specific event patterns through its event orchestration features.
What still remains: Orchestration rules route and suppress alerts, but they do not query Datadog metrics, CloudWatch log groups, or Sentry exception traces to explain why the event fired in the first place.
Step 2 — Enable Noise Filtering
Activate Intelligent Alert Grouping to cluster alerts by shared attributes such as service, host, region, deployment tag, and error code, which collapses alert storms into single incidents. Start with alert correlation and suppression on a small set of noisy services before expanding to the rest of the stack. Focus first on your two or three highest-volume services.
What still remains: Grouping reduces notification volume, but the grouped incident still arrives without a populated root-cause explanation. Engineers must open Datadog or CloudWatch manually to understand the blast radius.
Step 3 — Set Dynamic Triage Priority Conditions
Define priority rules using business-impact signals such as impacted user count, key transaction error rate, and critical service dependency status. These business signals drive priority-based triage in AIOps and help teams focus on high-blast-radius incidents. Map these rules to PagerDuty severity levels P1–P4 so responders receive pre-classified incidents.
What still remains: Priority classification tells the engineer how urgent the incident is, not what caused it. The log-hunt across GitHub commit history and Sentry error groups still begins at the engineer’s keyboard.
Step 4 — Define Auto-Remediation Thresholds
Use PagerDuty’s Automation Actions to trigger safe, low-risk remediations such as restarting unhealthy pods after repeated health-check failures, rolling back deployments when error rates spike after a new version, and triggering circuit breakers when dependencies degrade. Restrict autonomous execution to well-understood, reversible actions. Require human approval for novel or high-impact scenarios so closed-loop automation handles known cases while humans manage complex situations.
What still remains: Auto-remediation resolves a narrow class of known failure modes. Any incident outside those predefined patterns, such as a new code regression, an unexpected third-party API failure, or a subtle data pipeline corruption, still requires a full manual investigation.
Step 5 — Configure Slack AI Agent Prompts
Connect PagerDuty to Slack through the native integration and configure the PagerDuty Slack bot to post incident summaries, priority, and responder assignments directly into your #incidents channel. Add custom slash commands or workflow steps that prompt the bot to pull the latest status update or trigger a runbook link. This connection between Slack channels and PagerDuty on-call management enables coordinated incident response across telemetry and communication surfaces.
What still remains: The Slack bot surfaces the PagerDuty incident card, but it does not query CloudWatch log streams, correlate Sentry exception IDs, or cross-reference the triggering commit in GitHub. That investigation still happens manually in separate browser tabs.
Step 6 — Schedule Post-Incident AI Reviews
Enable PagerDuty’s AI-generated postmortem drafts after each resolved incident so the system can summarize the timeline, responders, and actions taken. Schedule a weekly review cadence to identify recurring patterns and tune orchestration rules accordingly. Use post-incident reviews to examine whether escalation happened too early or too late and then adjust thresholds.
What still remains: Postmortem drafts are retrospective and do not accelerate the next live investigation. The manual triage window remains open on every future incident.
Decision Framework: When to Let AI Handle vs. Escalate
Automation boundaries must be defined quantitatively to prevent both alert fatigue and missed incidents. An escalation threshold is a specific quantitative boundary such as more than 1,000 affected users, more than 20% error rate, or more than 15 minutes without acknowledgement that determines when human judgment is required. These thresholds must be calibrated carefully because thresholds set too low cause alert fatigue by escalating routine issues, while thresholds set too high cause missed incidents by allowing critical problems to go unnoticed.
A practical 2026 framework for SRE teams:
-
Automate (no human required): Known failure mode, reversible action, error rate under 5%, fewer than 100 affected users, P3–P4 severity.
-
Automate with notification: Moderate blast radius, P2 severity, auto-remediation action is reversible, confidence score above 85%.
-
Escalate immediately: SEV-1 full production outage or data loss affecting all users requires immediate escalation to senior SRE and engineering leadership. Any novel failure pattern, data integrity risk, or action that cannot be rolled back also requires human judgment.
LLM agents exhibit model-specific escalation profiles with implicit thresholds ranging from 53% to over 100%, and most are miscalibrated in self-estimated accuracy. Practitioners must empirically characterize escalation behavior before deploying automated decision-making in production incident workflows. Automation such as auto-escalation based on time thresholds provides a safety net but does not replace judgment.
PagerDuty + Struct: Closing the Investigation Gap
Struct is an AI-powered automated on-call investigation platform that integrates directly with PagerDuty and Slack. When an alert fires, Struct begins investigating immediately with no human prompting required. By the time the on-call engineer opens their laptop, Struct has already queried Datadog, CloudWatch, Sentry, and GitHub, correlated log IDs, mapped a unified timeline, identified the root cause, and posted a dynamically generated dashboard to the incident Slack thread.
Setup takes under 10 minutes: authenticate your alert source such as PagerDuty or Slack, connect your code repository such as GitHub, and link your observability stack such as Datadog, CloudWatch, Sentry, or GCP Logs. This process requires no enterprise deployment and no weeks of onboarding. Struct is SOC 2 and HIPAA compliant, which makes it suitable for fintech, healthtech, and any team operating under strict SLA requirements.
The Slack-native conversational bot allows engineers to ask follow-up questions such as “pull logs from 5 minutes prior,” “test whether this impacts user segment X,” or “verify if the error rate is still climbing” without leaving the incident thread. Teams can paste custom runbooks directly into Struct so the AI follows the team’s exact operational procedures on every alert. Struct delivers effective root-cause investigations and reduces manual investigation time.
See how Struct investigates alerts automatically — schedule a 20-minute live demo.
Automation Outcomes: PagerDuty Alone vs. PagerDuty + Struct
The comparison below shows how each configuration layer reduces manual investigation work, with the largest gains in root-cause speed and junior engineer readiness.
|
Metric |
Traditional Monitoring |
PagerDuty AI Alone |
PagerDuty + Struct |
|---|---|---|---|
|
Alert false positive rate |
reduced via AIOps |
reduced with transient-vs-critical classification |
|
|
Manual investigation time per incident |
extended |
partial automation of triage |
significantly reduced |
|
Root cause identification |
Manual, multi-tool |
Probable cause surfaced, manual log-hunt required |
Automated root-cause identification |
|
Junior engineer on-call readiness |
Requires tribal knowledge |
Partial, priority context provided |
Full starting point generated automatically per alert |
Customers using autonomous AI investigation agents report MTTR reductions up to 99% and investigation speed improvements up to 20x faster. Struct’s reduction in triage time aligns with these improvements and is documented in production deployments at Series A fintech companies operating under strict SLA windows.
Measuring Success: MTTR, Alert-Noise Ratio, and Onboarding Time
Three metrics determine whether an AIOps configuration is working: Mean Time to Resolution, alert-noise ratio, and time-to-first-on-call for new engineers.
Track MTTR at the P1 and P2 level weekly. A well-configured PagerDuty and Struct stack should show improved MTTR for known failure classes within the first 30 days. Alert-noise ratio, which is the proportion of actionable alerts to total alerts fired, should improve as orchestration rules and Struct’s transient-vs-critical classification layer mature together.
Common pitfalls to avoid:
-
Over-automation of novel failure modes: Closed-loop automation should be reserved for well-understood scenarios. Automating responses to patterns the model has not seen creates risk of incorrect remediation.
-
Weak telemetry foundations: Teams should avoid unbounded labels such as user IDs or request IDs and instead use aggregation, downsampling, and selective trace sampling to control cardinality. Struct and PagerDuty AI both depend on structured, queryable telemetry to function accurately.
-
Skipping the pilot phase: Start with alert correlation on a small set of noisy services before expanding. Deploying automation across all services simultaneously produces inconsistent results and erodes engineer trust.
-
Vague escalation criteria: Vague escalation criteria cause either over-escalation that burdens leaders with routine work or under-escalation that lets difficult situations fester.
Summary: The Fastest Path to Reliable, Low-Burnout On-Call
PagerDuty AI provides a strong foundation for noise reduction, intelligent grouping, priority triage, and basic auto-remediation. When configured correctly across the six steps above, it eliminates a significant portion of alert fatigue. The manual investigation gap that follows every non-trivial alert, however, remains open, and that gap is where engineer burnout, SLA risk, and onboarding bottlenecks live.
Struct closes that gap by investigating automatically the moment an alert fires and delivering a root-cause dashboard before the engineer is fully awake. Once integrated, Struct shortens triage time significantly and gives junior engineers a platform they can rely on from their first on-call shift.
Frequently Asked Questions
What minimum tooling maturity does a team need before Struct adds value?
Struct works best when a team already has structured alerting in place, meaning alerts are firing into Slack or PagerDuty, logs are collected in at least one observability platform such as Datadog, CloudWatch, GCP Logs, or Sentry, and code is hosted in GitHub. Teams do not need a mature AIOps stack or years of historical incident data. If alerts are firing and logs exist, Struct can begin generating root-cause investigations immediately after the 10-minute setup. Teams with no logging infrastructure or no alerting triggers will not get accurate output from any AI investigation tool, including Struct.
Is Struct compliant with SOC 2 and HIPAA requirements?
Yes. Struct is fully SOC 2 and HIPAA compliant. Logs and telemetry data are accessed and processed ephemerally, and they are not stored beyond the investigation window. This compliance posture covers the requirements of the vast majority of Seed-to-Series-C companies, including fintech and healthtech teams operating under strict data handling mandates. Teams with enterprise policies that require full on-premise deployment or zero-egress log access should evaluate whether Struct’s current architecture fits their specific constraints before proceeding.
How does the 10-minute setup claim hold up in practice?
The 10-minute setup involves three authentication steps: connecting an alert source such as a Slack channel or PagerDuty, linking a code repository such as GitHub, and authenticating at least one observability integration such as Datadog, CloudWatch, Sentry, or an equivalent tool. Once those three connections are live, Struct begins auto-investigating the next alert that fires into the configured channel. This process requires no custom model training, no lengthy indexing process, and no dedicated engineering sprint. Teams can also paste their existing on-call runbook directly into Struct during setup so the AI follows their specific operational procedures from the first investigation.
Can junior engineers safely handle on-call shifts with Struct in place?
Struct is designed to address the tribal knowledge gap that prevents junior engineers from taking on-call duties confidently. When an alert fires, Struct automatically generates a full investigation report that includes correlated logs, a unified timeline, blast radius assessment, root cause, and suggested fixes before the engineer needs to act. This report gives junior engineers a reliable and heavily contextualized starting point for every incident rather than requiring them to know which logs to query, which services to check, or which recent deployments to suspect. The Slack-native conversational bot also lets them ask follow-up questions in plain language without needing deep familiarity with the underlying observability tooling. Engineering leadership at a Series A fintech using Struct reported that new engineers were able to take on-call shifts confidently shortly after onboarding, with Struct providing the investigation scaffolding that previously only senior engineers could supply.
