AeionClaw for Ops Runbook Automation
AeionClaw responds to alerts autonomously — triages, executes remediation runbooks, escalates only the ones that need human judgment, and drafts post-incident summaries. Reclaim on-call burden. PagerDuty AIOps ($50K-200K/year add-on), Big Panda ($100K-500K/year), Moogsoft ($150K-700K/year) — AeionClaw ships free with Aeion Sentinel; Forge is included free with any module.
The On-Call Burden Problem
`
Claw's Runbook Automation Approach
`
Walkthrough — 200-Host Cloud Env, 4-Person SRE Team
`
Reaction + Runbook Configuration
```typescript
FAQ
Per-runbook flag `safe_to_auto_execute`. Conservative default — runbooks marked unsafe queue for human approval. Operators toggle the flag per runbook after observing 50-100 successful executions. Most teams settle at ~70% auto-execute / 30% approve over 90 days.
Every runbook step has a verification post-check + rollback recipe. If a step fails verification, the runbook escalates to human + drafts a "rollback plan" using the rollback recipe. Worst case: human reverts + Claw never auto-executes that runbook again until human re-enables.
Aeion Singularity has connectors for both. PagerDuty runbook articles + Datadog notebooks import directly as runbooks. Initial classification matches alert types; manual refinement to add verification + rollback.
Aeion Bridge ships adapters for SSH (with bastion + ProxyJump), kubectl (in-cluster or via kubeconfig), AWS CLI (with assume-role), GCP gcloud, Azure CLI, Terraform plan/apply, Ansible playbooks, custom REST APIs. Per-runbook step picks the adapter; per-tenant config gates which adapters are enabled.
Bridge runs with per-tenant scoped credentials (Vault-stored or AWS Secrets Manager). Per-runbook step requests minimum-required permissions. All actions are fully audit-logged — both the infrastructure command executed and the Claw decision that triggered it.
Yes — every Claw-handled alert surfaces in the ops dashboard. One-click "override + manual response" + Claw learns from the override (training signal for the classifier).
Claw drafts are designed to need only light editing before approval (vs 4-6 hrs to write from scratch). Sections: timeline, contributing factors, remediation taken, customer impact, suggested follow-ups. SRE owns the human-judgment sections (root cause hypothesis, action items, accountability).
Classifier outputs "investigation" + page on-call with full context preload. Over time, novel alerts become known-pattern as the team writes runbooks. Knowledge base grows via continuous resolution capture.
Per-cluster Bridge instance with scoped credentials. Per-runbook step specifies target cluster. Runbook engine handles concurrent multi-cluster execution.
Aeion can replace OR augment. Augment mode: PagerDuty alerts pipe into Aeion Sentinel → Claw triages → un-deflected alerts page via PagerDuty. Replace mode: Aeion Sentinel + Aeion Connect handles full incident lifecycle.