Turn telemetry into action: cut alert noise, predict incidents, find root cause and automate fixes with AI.
Build AI-assisted operations on a solid observability foundation: OpenTelemetry data, event correlation, anomaly detection, root-cause analysis and safe automated remediation. The path ends with 2026-era agentic operations, where MCP-connected AI SRE agents investigate incidents under human-in-the-loop guardrails.
AIOps applies machine learning, analytics and now large language models to operational data (metrics, logs, traces, events, topology and change records) so teams can detect problems earlier, cut alert noise, find root cause faster and automate the response. Done well, it turns thousands of raw alerts into a handful of context-rich incidents and measurably shortens time to detect and time to resolve.
The field changed sharply in 2025 and 2026. Gartner reframed AIOps platforms as event intelligence solutions to cut through vendor hype, and AI SRE agents became generally available from AWS, Microsoft, Datadog, PagerDuty and others, alongside open-source projects such as HolmesGPT. Platforms such as Dynatrace now pair deterministic causal AI with agentic AI so root-cause answers stay explainable while agents act within guardrails, and the Model Context Protocol has become the common way to wire agents into observability and ITSM tools.
This path is deliberately foundation-first, because agents are only as good as the telemetry, topology and runbooks they can reach. You start with OpenTelemetry and alerting hygiene, move through correlation, time-series ML and root-cause analysis, integrate with ServiceNow and runbook automation, and finish by building and governing an AI operations agent with approval gates and audit trails.
AIOps sits between SRE (SLOs, incident practice), MLOps (running models in production) and LLMOps (operating LLM applications), and it feeds CloudOps and FinOps, because the same telemetry and automation drive capacity and cost decisions.
6 stages · 28 topics · ~270 hours of focused learning. Work through the stages in order; optional topics are electives you can come back to.
The operational and telemetry groundwork every AIOps capability depends on: incident practice, the four telemetry signals, OpenTelemetry, alerting and the Python data skills used throughout the path.
Learn how incidents, problems and changes flow through an operations team and which metrics AIOps is meant to move. Without clear severities, ownership and SLOs you cannot tell whether a correlation rule or an agent actually helped.
Understand metrics, logs, traces, events and the newer profiles signal, and how OpenTelemetry standardises them with shared resource attributes and semantic conventions. Consistent attributes such as service.name and deployment.environment are what later make correlation, topology and ML possible.
Use Prometheus and Grafana to collect metrics, write PromQL and route alerts through Alertmanager. Learn why symptom-based, SLO burn-rate alerts produce far less noise than threshold alerts on every host, which is the cheapest noise reduction you will ever get.
Store and query logs with Loki or the Elastic Stack and traces with Tempo or Jaeger, then link them through trace IDs and exemplars. Cross-signal navigation is the manual version of what correlation engines and agents automate later.
Get fluent with Python, pandas and notebooks for pulling telemetry from APIs, reshaping time series and plotting results. Every ML and agent exercise later in the path is written in Python.
Milestone: Instrument a microservices app with OpenTelemetry, query its metrics, logs and traces in one Grafana workspace, and alert on an SLO burn rate.
The classic core of AIOps: getting events from many tools into one pipeline, normalising and enriching them, grouping related alerts into incidents and mapping services so impact and blast radius are visible.
Design pipelines that collect, buffer, enrich and route telemetry at scale with the OpenTelemetry Collector and Apache Kafka. Garbage in is garbage out: missing service names, exploding cardinality or broken timestamps silently ruin ML and correlation.
Map alerts from different tools into one event schema, deduplicate repeats, suppress flapping and maintenance noise, and enrich each event with owner, service and recent changes. Enrichment is what lets a responder, or an agent, act without opening five consoles.
Group related alerts into incidents using time windows, shared attributes, topology and ML similarity, and measure the result with compression ratio and missed-incident rate. This is where most commercial AIOps value is proven or disproven.
Build a live map of services and dependencies from traces, service catalogs and CMDB data. Topology turns a pile of alerts into an impact story and is the backbone of root-cause analysis and agent reasoning.
Milestone: Ingest alerts from three monitoring sources, deduplicate and correlate them into topology-aware incidents, and report the resulting noise-reduction ratio.
Practical time-series and log ML for operations: forecasting, anomaly detection, log pattern mining and when to reach for time-series foundation models, always evaluated against real incidents rather than demo data.
Learn trend, seasonality and decomposition, then forecast capacity and demand with classical models before trying anything fancier. Forecasts power proactive alerts such as disk-full predictions and capacity planning.
Move from static thresholds to dynamic baselines: robust statistics, seasonal baselines, Isolation Forest and multivariate detectors. The hard part is evaluation, so learn to measure precision, recall and alert volume against labelled incidents.
Turn unstructured logs into templates and counts with log parsers such as Drain, then detect new or spiking patterns. Pattern-level signals are far cheaper and more stable than per-line ML and feed both correlation and LLM summaries.
Explore pretrained forecasting models such as Amazon Chronos, Google TimesFM and Datadog Toto that work zero-shot across many metrics. Learn where they beat per-metric models and where cost, latency and explainability make classical methods the better choice.
Treat detectors like any production model: version them, track experiments, watch for drift as systems change and retrain using responder feedback. This keeps models trustworthy after every re-architecture or traffic shift.
Milestone: Build and tune a seasonal anomaly detector and a capacity forecast on real telemetry, and report precision and recall against labelled incidents.
How root-cause analysis really works, and how the leading platforms implement detection, correlation and RCA, so you can operate them well and choose between them with evidence.
Combine topology, change events and anomaly timing to rank probable causes, and learn the difference between causal analysis and correlation. Pair automated RCA with blameless postmortems so findings turn into fixes.
Learn how Dynatrace combines Smartscape topology, the Grail data lakehouse and deterministic causal AI, now extended with agents under Dynatrace Intelligence. It is the reference example of topology-first, explainable RCA.
Use Watchdog for automatic anomaly and root-cause detection, Event Management for correlation, and the Bits AI investigation agent for autonomous first-pass triage. Learn to judge what the AI found versus what it guessed.
Model services and KPIs with adaptive thresholds and episode grouping in Splunk ITSI, and compare the ML features in Grafana Cloud (forecasting, outlier detection, Sift) and Elastic. Many enterprises run more than one, so knowing the patterns transfers.
Run a fair proof of concept: replay the same historical alerts through each candidate, then compare noise reduction, missed incidents, RCA accuracy, integration effort, data residency and pricing. Include an open-source baseline so you know what you are paying for.
Milestone: Run a structured proof of concept comparing two AIOps platforms on the same incident set and recommend one using noise-reduction, MTTD and RCA-accuracy evidence.
Closing the loop: safe, auditable automation that fixes known problems, integration with ServiceNow so every action is tracked, and fault injection to prove detection and remediation actually work.
Codify runbooks and trigger them from events with Event-Driven Ansible rulebooks, Rundeck jobs or AWS Systems Manager Automation. Build in pre-checks, rate limits and rollback so automation never makes an incident worse.
Use Kubernetes probes, autoscaling and controllers for built-in recovery, and Argo Rollouts analysis to roll back bad releases automatically using live metrics. Since a large share of incidents start with a change, automated rollback is often the highest-value remediation.
Connect the AIOps pipeline to ServiceNow ITOM and ITSM: bidirectional incident sync, CMDB-backed impact, change-risk context and the agentic AIOps features in Now Assist for ITOM. This is where AIOps meets audit, compliance and the rest of the enterprise.
Inject realistic faults to prove that detection fires, correlation groups correctly, RCA points at the right component and remediation succeeds. Game days give you the labelled incidents that ML evaluation needs.
Milestone: Detect an injected fault, open and enrich a ServiceNow incident, and run an approved automated remediation end to end with a full audit trail.
The 2026 frontier: LLM agents that investigate incidents, query observability tools through MCP and propose or execute fixes, built and governed so that humans stay in control of anything risky.
Learn how LLMs reason over telemetry, runbooks and postmortems: retrieval, tool calling, structured output and evaluation. Understand failure modes such as hallucinated metrics so you design around them rather than discover them during an outage.
Expose observability, incident and ITSM systems to agents through Model Context Protocol servers, starting read-only and adding write tools deliberately. Learn authentication, scoping and how to stop a noisy log line from becoming a prompt injection.
Run and compare AI SRE agents: open-source HolmesGPT and K8sGPT, and managed options such as AWS DevOps Agent, Azure SRE Agent, Datadog Bits AI and PagerDuty's SRE Agent. Measure their root-cause accuracy and time saved on your own incidents, not vendor demos.
Decide what agents may do alone, what needs approval and what is forbidden, then enforce it with policy-as-code, scoped credentials and immutable audit logs. Map risks with the OWASP agentic top 10 and the NIST AI Risk Management Framework.
Build your own investigation agent as an explicit graph with tools, memory and human-approval interrupts, and trace every step with OpenTelemetry GenAI conventions. A custom agent lets you encode your topology, runbooks and policies rather than accept a vendor's defaults.
Milestone: Deploy an MCP-connected investigation agent that drafts root cause and remediation for real alerts, with human approval gates, evaluation results and full audit logging.
37 tools and platforms used across this path. Focus on concepts first — tools change, principles don’t.
Build these to prove your skills. Publish each one on GitHub with a clear README and architecture diagram.
Deploy the OpenTelemetry Demo on Kubernetes, send all signals through a Collector to Prometheus, Loki and Tempo, and build triage dashboards. Deliver multi-window SLO burn-rate alerts and a one-page alerting policy.
Feed alerts from Prometheus, a cloud monitoring service and a log tool into Keep or PagerDuty, normalise and enrich them with ownership and recent deploys, and correlate them into incidents. Report compression ratio and any missed incidents over a two-week replay.
Pull a month of service metrics, build seasonal baselines and an Isolation Forest detector, and forecast capacity with StatsForecast. Compare precision, recall and alert volume against static thresholds using incidents you labelled from chaos experiments.
Generate a service graph from traces, ingest deployment events and rank probable root causes for each correlated incident. Validate it with Chaos Mesh fault injection and publish an accuracy report covering top-1 and top-3 hits.
Using a ServiceNow developer instance, open enriched incidents automatically from correlated alerts, request approval in chat, run an Event-Driven Ansible remediation and resolve the ticket with an audit note. Include rate limits, rollback and a dry-run mode.
Build a LangGraph or HolmesGPT-based agent that investigates alerts through MCP servers for Grafana, Kubernetes and your incident tool, drafts RCA and a fix, and executes only after human approval. Ship an evaluation harness over 20 or more replayed incidents and OpenTelemetry traces of every agent step.
Certifications that validate this path’s skills. Always confirm the current exam version on the official page before booking.
DevOpsSchool
Hands-on, project-based programme that maps directly onto this path, from observability and event correlation to ML-driven detection and automated remediation.
Official pageCNCF / Linux Foundation
Validates the OpenTelemetry instrumentation, Collector and semantic-convention skills that underpin every correlation, ML and agent use case.
Official pageCNCF / Linux Foundation
Proves metrics, PromQL and alerting fundamentals, the most common data source for open-source AIOps pipelines.
Official pageDynatrace
Entry certification for Dynatrace, the reference platform for topology-based causal root-cause analysis.
Official pageDatadog
Covers Datadog data collection, tagging and visualisation, which you need before Watchdog, event correlation and Bits AI are useful.
Official pageSplunk (Cisco)
Current Splunk observability credential covering metrics, detectors, OpenTelemetry and Kubernetes; the older ITSI admin certification became a legacy credential in 2026.
Official pageRoles that hire for these skills.
Builds and tunes the event pipeline, correlation rules, anomaly models and automations that turn raw telemetry into actionable incidents. Owns noise-reduction, MTTD and MTTR metrics for the operations platform.
Defines SLOs and alerting, leads incident response and postmortems, and increasingly supervises AI agents that do first-pass investigation and propose fixes.
Designs OpenTelemetry instrumentation, telemetry pipelines and data models so metrics, logs, traces and topology are consistent, affordable and ready for ML and agents.
Modernises the NOC by integrating monitoring with ServiceNow, automating L1 triage and runbooks, and keeping humans in control of risky changes.
Builds, evaluates and governs LLM-based operations agents and their MCP tool integrations, including permissions, approval gates, evaluation suites and audit trails.
Observability is about collecting and exploring telemetry so humans can understand system behaviour. AIOps applies analytics, machine learning and now LLM agents on top of that telemetry to reduce alert noise, detect anomalies, find root cause and automate the response. You cannot do AIOps well without good observability, which is why this path starts there.
Yes. Agents are the newest layer of AIOps, not a replacement for it. They depend on clean telemetry, deduplicated and correlated events, accurate topology and codified runbooks, and they work best when deterministic detection and RCA give them reliable evidence. Teams that skip the foundations get agents that confidently investigate the wrong thing.
No. You need solid Python, basic statistics and an understanding of time series, all of which this path teaches in context. Most day-to-day AIOps work is data engineering, correlation design, evaluation and automation rather than inventing new algorithms.
Start with a vendor-neutral data credential such as the OpenTelemetry Certified Associate or Prometheus Certified Associate, then add a hands-on programme like DevOpsSchool's AIOps Certified Professional. Add a vendor credential such as Dynatrace Associate or Datadog Fundamentals when your employer standardises on that platform.
Yes. OpenTelemetry, Prometheus, Grafana, Loki, Tempo, Keep, Python ML libraries, Event-Driven Ansible, HolmesGPT and K8sGPT cover the full loop from telemetry to agentic investigation. Commercial platforms add scale, polish and support, and knowing the open-source mechanics makes you much better at evaluating them.
They are replacing much of the repetitive first-pass triage, not the people accountable for reliability. The work shifts towards curating telemetry and runbooks, setting guardrails and autonomy levels, reviewing agent findings and handling the novel incidents agents cannot. Engineers who can build and govern these systems are in high demand.
At about 10 hours a week this path takes roughly six to seven months. Engineers with existing SRE or observability experience can move faster through the first two stages, while the ML and agentic stages reward extra project time.
Join DevOpsSchool instructor-led programs with hands-on labs, real-world projects and certification guidance.
Roadmap reviewed October 2026 · Last updated 26 Oct 2026 · JSON