Versus Incident
An incident management tool supporting multi-channel alerting, customizable messages, on-call integrations, and the built-in AI SRE Agent. Compatible with any tool supporting webhook alerts.
Last verified:
What is Versus Incident?
Versus Incident is an open-source incident management tool designed for modern DevOps and Site Reliability Engineering (SRE) teams to quickly respond to production incidents. It supports alerting across multiple channels including Slack, Microsoft Teams, Telegram, and Email, with easy custom messaging using Go templates. The tool is compatible with any monitoring system that supports webhook alerts, making it a universal alert router for production environments.
The built-in AI SRE Agent (currently in Beta) is a key differentiator that continuously observes your logs, metrics, and traces to learn what normal behavior looks like. It only alerts you when something new and unexpected appears, significantly reducing alert fatigue by filtering out known patterns. This log-driven detection approach helps teams focus on genuine incidents rather than noise.
Versus Incident includes on-call integrations with AWS Incident Manager, allowing automatic escalation when incidents are not acknowledged within a configurable time window. The tool features a built-in admin dashboard (single-page React app) for triaging alerts, acknowledging on-call pages, and managing the AI agent's pattern catalog. It can be easily deployed via Docker, Kubernetes, or Helm chart, with YAML-based configuration and environment variable support.
Versus Incident pricing
Pricing model: Freemium
Versus Incident is completely free and open-source under the MIT License. There are no paid tiers, subscription plans, or licensing fees. The tool is distributed via GitHub Container Registry (ghcr.io/versuscontrol/versus-incident) and can be self-hosted on your own infrastructure. The project accepts GitHub Sponsors to fund critical infrastructure and accelerate development of new features like Viber/Lark integration, enhanced Web UI, and additional on-call integrations.
Versus Incident pros
- Open-source with MIT license - no licensing costs
- Multi-channel alerting to Slack, Teams, Telegram, and Email
- Custom alert templates using Go templates for any monitoring tool
- Built-in AI SRE Agent for intelligent anomaly detection
- AI Agent learns normal patterns and alerts only on unexpected events
- Simple REST API at /api/incidents for webhook integrations
- YAML-based configuration with environment variable support
- Built-in admin dashboard for incident triage and management
- On-call integration with AWS Incident Manager for escalation
- Docker, Kubernetes, and Helm chart deployment options
- Compatible with Alertmanager, Grafana, Sentry, CloudWatch, FluentBit
- Configurable acknowledgment wait time before on-call escalation
- Per-alert override via query parameters for channel and on-call
- Persistent incident storage with rolling cap to prevent unbounded growth
- Shadow mode to test AI patterns without sending alerts
- Pattern catalog management through the admin UI
- Supports AWS SNS integration for CloudWatch Alarms
Versus Incident cons
- AI SRE Agent is still in Beta stage
- Redis and database storage backends not yet implemented (file only)
- Admin dashboard requires GATEWAY_SECRET to function
- No built-in PagerDuty on-call integration yet (only AWS Incident Manager)
- Viber and Lark integrations still on roadmap, not available
- Web UI is basic - single-page React app embedded in Go binary
- Maximum 1000 incidents stored by default (configurable but limited)
- No Prometheus metrics endpoint yet (planned on roadmap)
- Requires separate Redis instance for on-call functionality
- Multi-template support still on roadmap (currently one template per channel)
Frequently asked questions about Versus Incident
What is Versus Incident and what does it do?
Versus Incident is an open-source incident management tool that supports alerting across multiple channels (Slack, Microsoft Teams, Telegram, Email) with custom messaging and on-call integrations. It is compatible with any tool supporting webhook alerts and is designed for modern DevOps teams to quickly respond to production incidents. The built-in AI SRE Agent continuously observes logs, metrics, and traces to learn normal patterns and only alerts on unexpected events.
How do I install Versus Incident?
The easiest way is via Docker: run 'docker run -p 3000:3000 -e SLACK_ENABLE=true -e SLACK_TOKEN=your_token -e SLACK_CHANNEL_ID=your_channel ghcr.io/versuscontrol/versus-incident'. Versus listens on port 3000 by default and exposes the /api/incidents endpoint. You can also deploy via Kubernetes with ConfigMaps and Secrets, or use the Helm chart at oci://ghcr.io/versuscontrol/charts/versus-incident.
What monitoring tools work with Versus Incident?
Versus Incident is compatible with any tool supporting webhook alerts. It has universal alert template support for Alertmanager (Prometheus), Grafana Alerts, Sentry, CloudWatch SNS, and FluentBit. The tool accepts JSON payloads from various monitoring systems via its REST API at /api/incidents and forwards alerts to configured notification channels.
How does the AI SRE Agent work?
The AI SRE Agent (Beta) continuously observes your logs, metrics, and traces, learning what normal behavior looks like. It only alerts you when something new and unexpected appears, reducing alert fatigue. The agent builds a pattern catalog of known events and can run in shadow mode to test patterns without sending alerts. You can manage patterns, assign verdicts (known, spike, custom), and tag patterns through the admin dashboard.
How do I customize alert messages?
Versus uses Go templates for custom alert messages. Create a template file (e.g., slack_message.tmpl) and specify its path in config.yaml under alert.slack.template_path. The template can access fields like ServiceName, Logs, UserID, and kubernetes metadata. You can enable debug_body:true to see the exact JSON payload structure for your monitoring tool, then create templates that extract relevant information.
What on-call integrations are available?
Versus Incident currently supports on-call integration with AWS Incident Manager. You need to configure the response_plan_arn and enable on-call with a wait_minutes setting (default 3 minutes) before escalation. Redis is required for on-call functionality to manage state. The on-call feature can be enabled globally or overridden per-alert using query parameters like ?oncall_enable=false or ?oncall_wait_minutes=0.
What channels can I send alerts to?
Versus Incident supports Slack, Microsoft Teams, Telegram, and Email out of the box. More channels are coming on the roadmap including Viber and Lark. Each channel can be enabled via environment variables (SLACK_ENABLE, TELEGRAM_ENABLE, MSTEAMS_ENABLE, EMAIL_ENABLE) and configured with tokens, channel IDs, webhook URLs, or SMTP settings as appropriate.
How do I send alerts to different Slack channels for different services?
You can override the Slack channel per alert using query parameters: POST /api/incidents?slack_channel_id=EMERGENCY-CHANNEL. For Microsoft Teams, you can define multiple webhook URLs in config.yaml under msteams.other_webhook_url (qc, ops, dev) and override using ?msteams_other_webhook_url=qc. This allows routing alerts to specific team channels based on the service or severity.
What storage options are available for incidents?
The default storage backend is file-based, writing JSON to ./data directory with incidents.json, patterns.json, and shadow.json files. The file storage has a rolling cap of max_incidents (default 1000). Redis and database storage types are currently config stubs that return 'backend not implemented' - stick with file storage in production until these features are implemented.
How do I access the admin dashboard?
The admin dashboard is a single-page React app embedded in the Go binary, available at the root path once the server is running. Set GATEWAY_SECRET environment variable (required for dashboard to function). Open http://localhost:3000/ in your browser after running Docker. The dashboard provides pages for Dashboard, Incidents, Incident detail, Agent status, Patterns, Shadow, and Services for day-to-day operations.