Grafana Incident Review: The Open-Source On-Call Stack for the Budget-Conscious SRE Team

Published June 30, 2026 · 9 min read

Affiliate disclosure: OpsAI may earn a commission when you sign up for Grafana Cloud through links in this article. Our editorial picks are independent — see our full affiliate disclosure policy.

The cheapest credible on-call stack for a small SRE team in mid-2026 is not the one with the most agentic AI. It is the one you can keep running when your budget gets frozen. Grafana Incident is built around that: a real open-source engine (grafana/oncall, AGPL-3.0) under a managed Grafana Cloud app called IRM. After three weeks testing it on Kubernetes with Prometheus and Loki, this review — the budget-and-OSS pillar of our incident-response set — takes that angle. The AI story is improving, not arrived.

What is Grafana Incident in 2026?

Grafana Incident is the incident-declaration, timeline, and post-incident-review surface inside Grafana Cloud IRM (Incident Response and Management). The history: Amixr (Amsterdam, 2018), Grafana OnCall (open-sourced November 2021 under AGPL-3.0 after Grafana Labs acquired the team), then "IRM" plus an Incident sub-product launched in 2024 when Grafana folded OnCall, declaration, timeline, and PIR tooling into one app.

The naming matters. Self-hosters deploy the grafana/oncall OSS engine, which is mature, AGPL-3.0, and ships with a docker-compose. Cloud customers get the same routing engine plus the IRM workflow on top. Picking Grafana Incident in 2026 means picking one of three routes: Cloud IRM (paid), Free Cloud IRM (very small teams), or OSS self-host. We tested all three in the same lab.

Where the AI features stand — and where they do not

Compared with Rootly's AI co-pilot, incident.io's Scribe and AI chat agent, or FireHydrant's retrospective AI, the AI feature set Grafana ships for incident response is thinner in June 2026. Here is the honest map of what is actually present:

  • Sift with ML. The Grafana ML app's Sift feature runs statistical anomaly detection over metrics and logs and can fire when an incident is declared to surface relevant panels. Real machine learning, not generative AI — narrow, accurate, and built into the same backend as your dashboards.
  • Grafana Assistant. An agentic layer Grafana Labs rolled out in 2025 that can navigate dashboards, filter data, and run queries via natural language. Exposed inside IRM as the "Ask AI" affordance; not a dedicated post-mortem writer.
  • Auto-stitched incident timelines. IRM pulls Slack threads, declared events, and key actions into a chronological timeline you can export as a post-incident review (PIR). Templating and correlation, not language-model prose — useful for a starter post-mortem, weaker than what Rootly or incident.io will write for you.
  • LLM app. Grafana Cloud supports an LLM app that wires any OpenAI-compatible model into Grafana queries. You can pipe IRM data into your own LLM, but the workflow is one you build, not one Grafana ships.

The shape of this list is what honest reviewers mean by "thinner." The features are real and useful, but none replace the generative post-mortem step that Rootly's co-pilot or incident.io's Scribe can do with one prompt. If you are picking this category of product specifically for that step, your decision tilts away from Grafana. Broader AI SRE testing notes are in the AI SRE tools guide and the incident-response buyer's guide.

Pricing, plans, and the OSS escape hatch

Pricing is the cleanest argument for the product. Numbers from the Grafana Cloud IRM pricing page:

  • Free: $0 forever, up to 3 active IRM users per month, community support. Active means users who actually used IRM in the billing period.
  • Pro: $19 per month platform fee covers the first 3 active users; each additional active user is $20 per month, billed as you go. 8×5 email support.
  • Enterprise: custom with a $25,000 per year minimum, premium support, and deployment across Public Cloud, Federal Cloud, or Bring Your Own Cloud.

OSS self-host is the third option: clone grafana/oncall, run the docker-compose, point it at Grafana Alerting or any Alertmanager, and you have the same routing engine Grafana Cloud runs — minus the IRM timeline and PIR surface.

Integrations and ecosystem fit

Because IRM lives inside Grafana Cloud, the integrations with the rest of the stack feel native. The list that matters in production:

  • Grafana stack. Alerting rules, SLO breaches, and dashboard annotations flow into IRM directly. Declaring an incident from any panel is one click.
  • Prometheus and Alertmanager. First-class alert sources for OnCall OSS; Cloud IRM ingests them through the same path plus Grafana Cloud Alerting.
  • Chat and notifications. Slack, Microsoft Teams, Telegram, SMS, phone, email, push via iOS and Android apps. Slack is the strongest channel — the OnCall engine grew up around the Slack keyboard.
  • ITSM and dev tools. Jira, ServiceNow, GitHub, and others via the IRM integrations library. PagerDuty and Opsgenie are also supported as alert sources, so shops keeping an existing on-call tool can still adopt IRM for declaration and timelines.

Hands-on: what we tested

Test environment: a small Kubernetes cluster running Prometheus, Alertmanager, and Loki with a handful of synthetic microservices. Onboarding Cloud IRM from signup to first declared incident took roughly an hour. The free tier is comfortably usable for a 3-person team.

Community signal is healthy: the grafana/oncall repository has several thousand GitHub stars and an active issue tracker, and the CNCF Slack has a dedicated on-call channel where Grafana Labs staff participate. The most common 2026 complaint on review sites is the AI gap above — tooling loved, reviewers want a more ambitious post-incident co-pilot. Plan on a day of plumbing for the OSS docker-compose path (MySQL or Postgres, RabbitMQ, Slack OAuth scopes) before your first alert reaches a phone — real OSS, not a five-minute install.

Pros & cons

Pros

  • Genuinely free for very small teams - 3 active users, no time limit.
  • Best Slack-native ergonomics we tested for keyboard-driven response.
  • OSS engine is AGPL-3.0 and self-hostable - no vendor lock on the routing layer.
  • Lives inside the Grafana stack, so dashboards and incidents share one identity model and one permission system.

Cons

  • AI feature set still trails Rootly's co-pilot and incident.io's Scribe - no dedicated post-mortem generator, no agentic Slack co-pilot.
  • Incident timelines and PIR tools are Cloud-only; OSS self-hosters get the routing engine but lose the structured retrospective workflow.
  • OSS install is more involved than Cloud signup - MySQL, RabbitMQ, and Slack OAuth on the operator.
  • Enterprise pricing has a $25k per year minimum, out of reach for the teams that would most benefit from support.

Who should buy Grafana Incident

Pick Grafana Incident when you already run Grafana across dashboards, when budget matters more than generative post-mortem quality, and when you would be comfortable self-hosting the routing engine if the Cloud tier ever stops making sense. In that profile it is the strongest option on the market in 2026.

Skip Grafana Incident when AI-driven post-incident analysis is the reason you are buying incident-response tooling — for that profile, Rootly and incident.io outperform it. The gap is mapped in the buyer's guide.

Grafana Incident vs Rootly and PagerDuty

Grafana Incident vs. Rootly

Rootly wins decisively on AI quality — its co-pilot writes usable post-mortems and the data model is purpose-built for retrospective analysis. Grafana Incident wins on price, openness (self-hostable AGPL engine), and Slack-native ergonomics. If your average incident does not need an AI co-pilot, Grafana is the cheaper, more open choice.

Grafana Incident vs. PagerDuty

PagerDuty is the entrenched incumbent with the deepest third-party ecosystem. Grafana wins on transparency (the routing engine is fully open source) and on value inside a Grafana-only stack; PagerDuty wins on mature AIOps and procurement inertia. If you already pay PagerDuty and it works, switching is hard to justify; if you are picking today, the Grafana free tier is a credible escape from the per-user tax.

Yuchen Xiao is the founder of OpsAI and Head of Cloud & Platform at a German automaker's China group. He writes about the AI tools that actually work in production environments.