On-call and incident response

Turn 3 a.m. alerts into
runbooks that handle them

Vesper checks every alert, folds the noise into one incident and runs the steps your team wrote down. It wakes a person only when a step needs one.

Explore the platform
4.8from 600+ on-call teams

Keeping nights quiet for
900+ engineering teams

Why Vesper

As Services Multiply,
Every Alert Starts
Sounding the Same

checkout-api latency
nice catch!

Why teams move to Vesper

One slow deploy can fire 41 alerts across latency, errors and queue depth, and people learn to swipe them away. Vesper folds them into one incident, confirms it is real and runs the steps your team already agreed on. A page reaches a person only when a person has something to do.

View use cases
Blossoming trees against a night sky with faint stars

What a runbook did at 02:14 last night

INC-2317 at Larkspur: checkout slowed down after a late deploy. Every step on the right ran on its own while the Checkout rotation slept.

People paged
0
Alert to mitigated
1m 28s
Alerts folded
41 into 1
SEV2INC-2317checkout-api p99 latencyResolved
  1. Alert

    Datadog: checkout-api p99 at 1.84s, threshold 1.2s

  2. Validate

    Confirmed in 3 of 3 regions, not a flap

  3. Group

    41 related alerts folded into INC-2317

  4. If / Else

    Deploy in the last 30 min: yes, v412 at 01:52

  5. Action

    Rolled back checkout-api from v412 to v411

  6. Check

    p99 back to 240ms after 90s

  7. Status

    Status page: “Slow checkout” marked resolved

  8. Postmortem

    Draft created for Tomás Ortega, for the morning

Nobody was pagedRunbook checkout-api latency v12

The first ten minutes,
handled the same way every time

The steps your best responder takes half asleep, written down once and run in order. Each step logs what it saw and what it did.

checkout-api p99 > 1.2sus-east
checkout-api 5xx rate 2.1%eu-west
orders queue depth 18kus-east
checkout-api p99 > 1.2sap-south
41
INC-2317 · checkout-apilatency, 5xx, queue depth · 5 min window

Group the noise

Same service, same five minutes, similar signal: one incident. Last month 12,486 alerts became 214 incidents.

us-east-1
eu-west-1
ap-south-1

Confirmed in 3 of 3 regions · held 3 min

Check it is real

Confirm in more than one region, compare with the last deploy, ignore anything that flaps for under three minutes.

Roll back checkout-apiv412 → v411
  • Drain 12 pods
  • Deploy v411
  • Wait 90s, check p99

p99 1.84s → 240ms

Run the fix

Roll back, scale out, restart, flush a cache. Every action has a guard, a timeout and a way to undo it.

Paging Tomás OrtegaCheckout primary · on call until 09:00

Rollback did not bring p99 under 400ms. Context attached: 41 alerts, deploy diff, last 3 incidents.

Escalates to Maya Raman in4:59

Page the right person

When a step needs a human, Vesper pages whoever holds that service's rotation, with everything the runbook already found.

Larkspur status

CheckoutDegraded
PaymentsOperational
SearchOperational
Slow checkout

Posted by Vesper · runbook checkout-api latency

Keep the status page honest

The runbook posts the first update within a minute and the resolution when its checks pass. Your customers hear from you before they ask.

Replay last week before you trust it tonight

Dry-run any runbook against real alerts from the past seven days. See what it would have closed, fixed or paged, without touching production.

  • Runs against recorded alerts and metrics
  • Actions are simulated, never executed
  • Diff two versions of a runbook side by side
Open the runbook editor
Dry runcheckout-api latency · v12 vs last 7 days
WhenAlertWould have
0 closed as noise0 fixed0 paged a person
A small white observatory on a hilltop at blue hour, one window lit
On call nowTomás OrtegaCheckout primary · handoff to Sam Okafor at 09:00

Rotations that respect the people on them

Vesper counts the nights, not only the shifts. Night pages are tracked per person, swaps take two taps and handoff notes travel with the pager.

MonTueWedThuFriSatSun
Primary
Tomás
Sam
Secondary
Maya
Hana
Sam asks to swap Friday nightFri 17 Oct, 18:00 to 09:00 · he takes your Tue 21

The postmortem is drafted before standup

Vesper imports the timeline, the graphs and the runbook log into a draft. The owner adds what only a person knows: why, and what changes.

INC-2317 · SEV2 · Thu 16 Oct

Slow checkout after deploy v412

Summary

Timeline imported from INC-2317

  1. v412 deployed by CI, approved by Sam Okafor
  2. p99 above 1.2s in 3 regions, 41 alerts grouped
  3. Runbook rolled back to v411
  4. p99 at 240ms, status page resolved

Action items

  • Make the fraud check async behind a flagTomás · Oct 23
  • Block deploys to checkout after 23:00 without an overrideMaya · Oct 20

Measured in sleep, not only in minutes

Larkspur, 40 engineers across four teams, last 30 days on Vesper.

Time to acknowledge1m 52swas 6m 40s
Time to resolve18m 40swas 47m
Pages per on-call night0.3was 2.4
Hours of sleep interrupted4.2 hwas 38 h a month
Hours of sleep interrupted per monthAll four teams · Vesper from April

“Thursday nights were the ones people swapped away, because that was release day. Now the runbook takes the first look. Last month the Checkout rotation was woken up twice.”

Lars EklundHead of Platform, Larkspur
Layered hills at blue hour with mist in the valleys
Shadow mode · day 1The runbook suggests, people act

Running by the end of the afternoon

  1. 1

    Connect alert sources

    Point Datadog, Grafana, Prometheus or CloudWatch at one webhook. Grouping starts with the first alert.

    10 min
  2. 2

    Import your runbooks

    Paste the wiki page. Vesper turns the steps into a flow you can edit, then dry-run against last week.

    1 hour
  3. 3

    Set the rotations

    Import schedules from a calendar or another pager. Overrides, swaps and escalation come along.

    20 min
  4. 4

    Go to bed

    Start in shadow mode. Switch a runbook to live when its replay matches what your team would have done.

    tonight

Works with the tools already on your pager

  • Datadog
  • Grafana
  • Prometheus
  • CloudWatch
  • Sentry
  • Kubernetes
  • GitHub
  • Argo CD
  • Terraform
  • Slack
  • Microsoft Teams
  • Google Calendar
  • Jira
  • Linear
  • Zoom
  • Twilio

Priced per responder, not per alert

Starter

$0up to 5 responders

For a small team with one rotation and a handful of services.

  • 1 rotation, unlimited alerts
  • Noise grouping
  • 3 runbooks in shadow mode
  • Public status page
Start free

Team

$21per responder / month

For engineering orgs that want runbooks to take the first page.

  • Unlimited rotations and overrides
  • Live runbooks with dry run
  • Postmortem drafts
  • Insights on sleep and load
  • Slack and Teams war rooms
Get started

Scale

Customfrom 150 responders

For companies with audit needs and many teams on call.

  • SSO, SCIM and audit log
  • Approval steps in runbooks
  • Private status pages
  • 99.99% uptime SLA
Talk to us

Questions on-call leads ask

Still unsure if a runbook should touch production at 3 a.m.? Talk to someone who has carried the pager.

Talk to an engineer
What if a runbook does the wrong thing?

Every action has a guard (for example, only roll back if a deploy happened in the last 30 minutes) and a timeout. If a check fails, the runbook stops and pages the rotation with what it saw. Every action can be undone from the incident.

Can we start without letting it touch production?

Yes. Shadow mode runs the whole flow and posts what it would have done in the incident channel. Most teams run shadow mode for one or two weeks, then replay the period before switching a runbook to live.

Do we have to move off our current pager?

No. Vesper can sit in front of it and forward only the pages that need a person. Teams that switch fully import schedules and escalation policies in one step.

How does noise grouping decide what belongs together?

By service, a time window (five minutes by default) and signal similarity. You can see why each alert joined a group, split it, or write a rule for the next time.

Where does our data live?

In the EU or US region you choose. Alert payloads are kept for 90 days on Team, longer on Scale. We never train on your data.

Who counts as a responder?

Anyone who can be put on a rotation or paged. Viewers, stakeholders and status page subscribers are free.

A quiet wooden house at the edge of a forest at night, one window lit, a cherry tree in bloom beside it

Give tonight’s first page to a runbook

Free for up to five responders. Shadow mode from day one.

Concept · AriadnePT