ES Sign in Try CloudGuard

AI root cause analysis for on-call teams

CloudGuard starts from the alert you already get, investigates across AWS, Azure and Google Cloud, and hands you the root cause in under 2 minutes, with the evidence behind every line.

Try CloudGuard See a real report

Every incident, investigated with evidence

Every alert opens an investigation. CloudGuard checks what changed against how your service behaved, and every sentence links to its proof. When the evidence falls short, it says so. See the workflow

One agent for AWS, Azure and Google Cloud

Connect each cloud once. CloudGuard reads its changes, logs and metrics, and every report looks the same, whatever the cloud.

  • Kubernetes and OpenShift clusters included
  • Several accounts and regions in one investigation
  • Each account connects with one command

Starts from the tools your team already uses

An alert from your monitoring, or a message in your chat, opens an investigation. The report comes back in the same thread.

  • PagerDuty
  • Slack
  • Opsgenie
  • Microsoft Teams
  • Jira
  • Google Chat
  • Discord
  • Datadog
  • Grafana
  • CloudWatch
  • Prometheus
  • New Relic
  • Sentry
  • Splunk
  • Elastic
  • Dynatrace

From alert to root cause in 3 steps

1

Receives the alert

PagerDuty, Datadog or any webhook opens an investigation for the service.

  • checkout-svc: elevated 5xxPagerDuty · triggered, high urgency
  • CloudGuard is investigating#incidents · report in this thread
  • payments-api: p99 over 2 sDatadog monitor · warning
2

Checks every lead at once

It compares what changed with how the service behaved, in parallel.

3

Writes the cited report

Root cause, timeline, discarded hypotheses and next steps, ready to approve.

Report 2041
5 of 5
  • Root cause, confidence high
  • Next step: roll back to app:12
  • 7 evidence records cited
  • 2 hypotheses discarded
  • Timeline of 4 events

Read-only by design, inside your cloud

The agent runs in your own account under a read-only role. Logs and metrics are read where they live; only the report leaves.

  • Write calls are refused by the provider, not by a promise
  • The model runs in your cloud’s AI service, billed to you
  • Roles and approvals per account and per team
Read the security questions
What CloudGuard may do
5 of 9 on
  • Read logs and metricsCloudWatch, Azure Monitor, Cloud Logging
  • Read change historyCloudTrail, Activity Log, Audit Logs
  • Read configurationDeployments, IAM, network
  • Change or delete resourcesRefused by the read-only role
  • Change permissionsRefused by the read-only role
  • Roll back a deployThe report proposes it; your team runs it
  • Copy logs out of your cloudLogs and metrics stay where they are
  • Call the AI modelAmazon Bedrock, Azure AI Foundry, Vertex AI
  • Send the reportTo the CloudGuard app and your chat tool

Questions

What on-call teams ask before they connect a cloud account.

  • AWS
  • Azure
  • Google Cloud
  • Kubernetes
  • OpenShift

Which clouds does it support?

AWS, Azure and Google Cloud, plus Kubernetes and OpenShift clusters running on any of them.

Can it change my cloud account?

No. It runs under a read-only role, so the cloud provider itself refuses any write call.

Where do my logs and metrics go?

They stay in your account. Only the investigation’s progress and the report leave it.

What if it cannot find the cause?

It says so. The report lists the missing evidence and the next checks to run, instead of guessing.

Which AI model does CloudGuard use?

Claude Sonnet 4.6 by default, in your own cloud’s AI service and billed to your account.