Versus Incident
A self-hosted alert router that also tries to learn what "normal" looks like for your system, so it pages someone only for genuine anomalies instead of every rule-based threshold trip — free, open source, plugs into your existing monitoring and on-call to
🔗 Visit Versus Incident
Description
Most alerting is rule-based: if CPU crosses 90%, page someone — regardless of whether that spike is a real problem or just Tuesday's batch job. That approach tends to produce alert fatigue, where real incidents get lost in noise nobody trusts anymore. Versus Incident tries a different approach: rather than you writing and maintaining ever-more-specific rules, it learns what your system's logs normally look like and escalates only what deviates from that baseline — closer to a smoke detector that's learned to ignore your kitchen's regular cooking smoke.
Versus Incident is an open-source (MIT) self-hosted alert-routing and anomaly-detection tool. It receives webhooks from Alertmanager, Grafana, Sentry, CloudWatch SNS, and FluentBit, routes notifications to Slack, Microsoft Teams, Telegram, Viber, Email, or Lark, and can hand off to on-call systems including AWS Incident Manager, PagerDuty, Opsgenie, incident.io, or ServiceNow. It includes an admin dashboard, REST API, Go template-based message formatting, Redis-backed state, and Kubernetes/Helm deployment support. The core webhook-routing functionality is production-ready; the AI-driven anomaly-detection layer is explicitly described by the project as still evolving.
💬 Our review
The short version: the alert-routing half of Versus Incident is a solid, free, self-hosted glue layer between your monitoring stack and your on-call tool — the 'AI agent that learns normal and escalates only anomalies' half is the more interesting pitch, but it's explicitly still maturing, so evaluate it as two products bundled into one.
As a router alone it's genuinely useful: wide webhook source support (Alertmanager, Grafana, Sentry, CloudWatch) and wide destination support (major chat tools plus PagerDuty/Opsgenie/incident.io/ServiceNow) means it can sit in the middle of a stack you already have without forcing you to switch on-call tooling. The anomaly-detection angle addresses a real pain point — alert fatigue from static thresholds — and if it delivers on that promise it's a meaningfully better default than rule-based alerting.
The honest limits: the project's own docs flag the AI features as shipping in a follow-up milestone, so don't adopt this specifically for anomaly detection today — evaluate the routing functionality now and treat the AI layer as something to revisit. At 744 stars it has real traction but is still young for a system you'd trust to decide what does and doesn't wake someone up at night; log source support is also currently limited (Elasticsearch, file-based), so check it covers your actual log pipeline before committing. Compared to a mature router like Grafana OnCall or a pure anomaly-detection product, this is best understood as an ambitious, actively-developed project worth watching rather than a finished, best-in-class tool yet.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source (licence MIT), gratuit, auto-hébergé (Docker/Kubernetes/Helm). Une offre entreprise est évoquée mais non détaillée publiquement.
Pros
Gratuit, open source (MIT), auto-hébergé
Larges intégrations en entrée (Alertmanager, Grafana, Sentry, CloudWatch SNS) et en sortie (Slack, Teams, PagerDuty, Opsgenie, incident.io, ServiceNow)
Approche de détection d'anomalies (apprentissage du comportement normal) plutôt que règles statiques figées
Projet actif (744 étoiles, développement continu), déploiement Kubernetes/Helm
Cons
La fonctionnalité IA de détection d'anomalies est explicitement présentée par le projet comme encore en évolution — pas encore mature
Support des sources de logs limité actuellement (Elasticsearch, fichiers) — à vérifier selon votre pipeline
Projet jeune pour une catégorie où la fiabilité (qui réveille qui, à 3h du matin) compte particulièrement