Integration Overview

This page explains how Integration connects Lorel.ai to external services and cloud environments, and describes its two main features, Sources and Access.

Overview

Integration in Lorel.ai connects Lorel.ai to external services and cloud environments, and supports the full operations workflow: detecting, investigating, and recovering from failures.

Integration consists of two features: Sources, which bring in events and alerts, and Access, which connects Lorel.ai to your cloud environment. In the sidebar, [Sources] and [Access] appear under [Integration].

1. Sources receive the alerts and events that occur in your external services.
2. Rules evaluate incoming events and can create incidents and start cause analysis by AI agents.
3. Runbooks and AI agents connect to your cloud environment through Access to investigate and to run recovery operations.

Some buttons and messages say “data source” for Sources and “access” for Access (for example, [Add data source] and [Add access]).

Sources

Sources bring the events and alerts that occur in external services into Lorel.ai.

Sources receive events through webhooks and message notifications from monitoring tools, incident management tools, source code management services, and similar services. For some services, such as Amazon CloudWatch metrics, Lorel.ai uses Access to collect the data from its own side.

Trigger rules (detection rules, compound rules, and metric rules) evaluate the events and metrics that Lorel.ai receives. You set the conditions for creating incidents automatically in incident policies. For details, see Rules Overview.

What you can do

Common specifications

Status management

You turn each Source on or off individually.

• When you activate a Source, it starts receiving and processing events (for CloudWatch Metrics, it starts collecting metrics). For a Source that receives events, you turn each endpoint on or off individually, and the Source receives nothing unless at least one endpoint is enabled.
• When you deactivate a Source, it stops receiving and processing events (for CloudWatch Metrics, it stops collecting metrics). A newly created Source is registered as inactive.

Filtering the list

Use the buttons at the top of the Sources list to filter it by status.

• [All] shows every registered Source.
• [Active] shows the Sources that are currently receiving and processing events.
• [Inactive] shows the Sources that are stopped.

Validation when an event is received

Lorel.ai checks the following for every incoming event:

• The receiving endpoint is valid
• The sender is legitimate
• The event type is recognized
• The Source is active

Eliminating duplicate events

If the same event is sent more than once because of a network failure or a retry by the connected service, Lorel.ai detects the duplicate events automatically. It treats an identical event that arrives at the same Source within 72 hours as a duplicate and excludes it from rule evaluation. This prevents incident creation and AI analysis from running more than once. Lorel.ai doesn’t treat events that arrive at different Sources as duplicates.

Service-specific settings

For service-specific settings, such as credentials, webhook settings, and event types, the setup instructions are shown on the screen that opens when you select [Add Endpoint] on the Source detail screen, or on the screen shown after you add an endpoint (for example, [Datadog-side setup instructions] for Datadog).

Access

Access manages the IAM role that Lorel.ai uses to connect to your AWS environment, and the scope of operations that you allow.

Lorel.ai uses Access to run investigation and recovery operations in Runbooks, to let AI agents investigate (read-only; only [Active] Access entries whose allowed operations are read-only can be used, excluding manually approved ones), and to collect CloudWatch metrics.

What you can do

Common specifications

Status management

Lorel.ai manages the status of each Access entry.

• [Pending verification] is the status right after you create an Access entry, or right after you change its connection settings. To activate the Access entry and start using it, run [Verify settings] on the screen and pass the verification, or have a Project Administrator approve it manually.
• [Active] means that the Access entry passed [Verify settings] and was activated.
• [Manually approved] means that a Project Administrator approved the Access entry manually to activate it. The approval is valid for 90 days.
• [Suspended] means that the Access entry can’t be used, for example because an approval expired, [Verify settings] failed for an Access entry that was already activated, or the project’s permission for manual approval was turned off.
• [Re-enable required] means that the project’s permission for manual approval was turned off and then on again, and the manually approved Access entry hasn’t returned automatically. A Project Administrator must re-enable it.

The difference between Active and Manually approved

Both [Active] and [Manually approved] mean that you can use the connection, but they differ in nature.

• An [Active] Access entry runs operations within the scope you selected.
• A [Manually approved] Access entry runs operations that a Project Administrator has declared beyond the selected scope, on that administrator’s responsibility. The approval expires after 90 days, and you can’t use the Access entry for AI agent investigations or CloudWatch metrics collection. Only Project Administrators can add or change a Runbook step that references a manually approved Access entry, or activate or duplicate such a Runbook. In addition, only Project Administrators can turn on [Allow execution by WORKER] for a Runbook that reaches a manually approved Access entry.

Lorel.ai re-checks the trust policy (the External ID condition) of the target role automatically on a recurring basis. The re-check applies to [Active] and [Manually approved] Access entries.

Filtering the list

Use the buttons at the top of the Access list to filter it by status.

• [All] shows every registered Access entry.
• [Active] shows the Access entries that were activated through [Verify settings].
• [Manually approved] shows the Access entries that were activated through manual approval.
• [Pending] shows the Access entries that aren’t verified yet, such as one that was just created.
• [Suspended] shows the Access entries that are stopped, including those in the [Re-enable required] status.

Verification and manual approval

There are two ways to activate an Access entry.

1. [Verify settings] (recommended). When you run [Verify settings] on the screen, the system automatically checks that the trust policy of the target role trusts Lorel.ai correctly (that the role can be assumed, and that the External ID condition matches).
2. [Manually approve and activate] (manual approval). Use this when you want to run operations that you declare in a Runbook beyond the scope you selected. Even with manual approval, the trust policy check of the target role must pass.

Manual approval takes two steps.

1. Allow it in the project. A Project Administrator allows manual approval from [Manual-approval settings] in the upper-right corner of the Access list.
2. Approve each Access entry. If [Verify settings] fails, [Manually approve and activate] appears on the detail screen of each Access entry (or on the creation screen); run it. For an Access entry that is already [Active], select [Switch to manual approval] on the detail screen, and then run [Approve and switch]. This switch can’t be undone.

With manual approval, you can run operations that you didn’t select, and operations that Lorel.ai doesn’t normally allow (such as destructive operations), as long as you declare them. Some operations, such as retrieving secrets directly or issuing temporary credentials, can’t run even if you declare them. For details, see Runbooks Overview. Check the operations you declare carefully before you approve.

Validity period of manual approval

An Access entry that was activated by manual approval has an expiration date. When 90 days have passed since the approval date, the approval expires and the Access entry becomes suspended. To use it again, a Project Administrator must approve it manually again.

Passing [Verify settings] doesn’t restore an expired manual approval.

Likewise, if the project’s permission for manual approval is turned off and then turned on again, a manually approved Access entry doesn’t return automatically and its status becomes [Re-enable required]. A Project Administrator must re-enable it from the banner at the top of the Access list.

Re-verification after a settings change

If you change the ARN of the target role or the scope of the operations that you allow, a verified or manually approved Access entry returns to [Pending verification], as a safety measure. To use the Access entry after the change, you must pass [Verify settings] again or approve it manually.

Changes to items that don’t affect the connection settings, such as the display name and the description, aren’t affected.

Permission management

An [Active] Access entry runs operations only within the scope of operations that you selected, and only within the permissions that the target role allows. A [Manually approved] Access entry can also run operations that are declared beyond the selected scope, under the responsibility of a Project Administrator, but never beyond the permissions that the target role allows. You can select a scope of operations that fits your purpose, so you can operate with the minimum permissions.

Secure connection

Lorel.ai uses an External ID to confirm the trust relationship with the target environment and prevent unauthorized connections. You can review the trust policy and External ID setup for the IAM role from [View setup guide] on the Access detail screen.

Notification when an Access entry is suspended

When the system suspends an Access entry, Lorel.ai sends a notification to the Project Administrators. You can change whether you receive the notification in your notification settings. Lorel.ai doesn’t send a notification when the Access entry stops because the project’s permission for manual approval was turned off.

You can’t use a suspended Access entry for investigation or for running Runbooks. To resume using it, check the cause, and then run the re-verification or re-approval that is needed.

Roles and permissions

Integration is managed per project. Depending on the operation, you need one of the following project roles.

Note: [Try the connection] is in the verification panel, next to [Verify settings]. Every role can see it while an Access entry is [Pending verification] or [Suspended]. While it is [Active] or [Manually approved], only Editors and above see the [Re-inspect settings] button that opens the panel.

Note: Control is based on the project role, which is independent of the organization role. For details, see Roles and Permissions.

Note: Restrictions based on your contract’s payment status or the project’s state can also apply to write operations. For restrictions when a payment is late, see Restrictions When Payment Is Delayed.

Limitations

• Number of Sources
  • The number of Sources you can register depends on your plan. Starter allows up to 10 for the whole organization, and Standard and Enterprise have no limit. For details, see Plans and Pricing.
• Number of Access entries
  • There is no plan limit on the number of Access entries you can register.
• Duplicate names
  • You can’t create multiple Access entries with the same name in the same project.
  • For Sources, there is no restriction on duplicate names, even in the same project (you can register multiple Sources with the same name).
• Reissuing secrets
  • For some connected services, Lorel.ai can’t reissue the secret. In that case, reissue it in the connected service, and then update the settings.

Related features

• Rules Overview (detection rules, compound rules, and metric rules that evaluate events and metrics received from Sources, and incident policies that create incidents automatically)
• Runbooks Overview (use Access to investigate and recover the target environment)
• AI Agents Overview (use Access to investigate by reading the target environment)
• Roles and Permissions (details of the Project Administrator, Editor, Worker, and Viewer permissions)
• Plans and Pricing (usage limits and pricing for each plan)