How Cleric Works

How Cleric investigates and learns

Cleric connects to your existing observability stack and infrastructure through read-only integrations. When an investigation starts, Cleric queries your systems to gather evidence, correlates findings across data sources, and delivers results in Slack. Through each investigation, Cleric learns your environment and improves its analyses.

Architecture

Investigation Flow

1. Trigger: An alert fires, you mention @Cleric in Slack, or you start an investigation from the web app

2. Context retrieval: Cleric recalls relevant memories and environment knowledge

3. Planning: Cleric analyzes the problem and creates an investigation plan

4. Data gathering: Cleric queries your connected integrations for relevant logs, metrics, and system state

5. Correlation: Cleric connects evidence across systems to identify patterns and root causes

6. Results: Cleric posts findings to Slack with evidence links and recommended actions

Learning

Cleric builds knowledge of your environment through two mechanisms:

• Environment extraction: Cleric automatically discovers naming patterns, service relationships, and infrastructure topology from the data it queries during investigations

• Memories: Facts learned from your conversations, such as service dependencies or known issues, that Cleric recalls in future investigations

See How Cleric Learns for details.

Data Flow

Cleric runs in a dedicated, single-tenant environment. Your data never mixes with other customers.

• Integrations: Cleric authenticates using scoped credentials you provide (API keys, service accounts, tokens)

• Queries: All queries are read-only by default

• Storage: Cleric stores investigation data (queries made, reasoning, responses) but does not store your observability data. Logs, metrics, source code, etc. are queried at runtime and not persisted.

• Communication: Results are delivered via Slack or the Cleric web interface