Contents

Siren Documentation

TL;DR

Siren is an incident management and on-call alerting platform. Send alerts to Siren, and we'll make sure the right person gets paged.

  • Magic link auth – no passwords, just enter your email
  • Organizations contain your services, incidents, and team members
  • Services represent systems you monitor; each has its own email address for receiving alerts
  • Incidents are created when Siren receives an email; duplicates are grouped by subject
  • On-call rotations determine who gets paged (daily or weekly rotation)
  • Alerting – primary gets paged immediately, reminded at 2 min, escalated to secondary at 5 min
  • Acknowledge to stop reminders; Close when resolved
  • 25 free incidents to start, then $0.20/incident (50 incident monthly minimum)

Authentication

To get started with Siren, visit siren.splitrockai.com. Siren uses Magic Link authentication—no password required. The service is currently available to users in the United States.

Enter your email address and click Send Magic Link. You'll receive an email containing a secure link to log in.

New users will be guided through a brief onboarding process. Returning users are taken directly to the Incidents page.

Onboarding

New users complete a brief onboarding process to set up their account:

  • Your first and last name
  • An organization name (defaults to "Your Name's Org")
  • The timezone your organization operates in
  • A description of the organization

Next, you'll verify your phone number. This is required—Siren calls you when incidents occur, so we need a verified phone number to reach you.

Finally, you can invite team members by entering their email addresses. This step can be skipped and done later from Organization Management.

Your Siren Email Address: At the end of onboarding, you'll receive a unique Siren email address for your default service. Send alerts to this address to create incidents in Siren. You can rename or configure this service later from Service Management.

Organizations

An Organization is the top-level container in Siren. All services, incidents, and users belong to an organization. Billing is also managed at the organization level.

No Limits: There are no per-seat fees and no limit on the number of services you can create.

Users can belong to multiple organizations. Your current organization is always shown in the top navigation bar. Click it to open a dropdown where you can:

  • Manage Organization – access settings, members, and services
  • Switch organizations – move between orgs you belong to
  • Create a new organization – set up a separate workspace

Organization Management

Roles

Members of an organization will be assigned one of three roles:

Role Capabilities
Member Can be part of an on-call rotation, create, acknowledge, add notes, and close incidents. Members can also add scheduled overrides.
Admin Can do everything a member can, plus administer all aspects of the organization except Billing.
Owner Can do everything an admin can, plus manipulate billing settings.

Organization Details

The Organization Details card shows the organization name, creation date, and your role. Owners and Admins can modify organization settings here.

  • Timezone – controls how all dates and times are displayed throughout Siren for this organization.

Billing & Usage

The Billing & Usage card is only visible to Owners.

From here, owners can:

  • View how many free incidents have been used
  • Add a payment method via Stripe
  • View invoice history and details

Signal Rules

Signal Rules enable automatic incident resolution based on alert and recovery patterns. When your monitoring tools send both "firing" and "resolved" alerts, Siren can automatically close incidents when the problem is resolved.

Signal rules are configured in Organization Settings. Siren provides built-in rules for common monitoring tools:

Rule Alert Pattern Recovery Pattern
Cloudflare DOWN | UP |
Prometheus [FIRING:1] [RESOLVED:1]
Grafana [Alerting] [OK]
How It Works
  1. Enable a rule for your organization in Organization Settings
  2. When an email arrives, Siren checks if the subject starts with an alert pattern (e.g., [FIRING:1] Server Down | us-east-1)
  3. If matched, Siren extracts the instance identifier (everything after the pattern: Server Down | us-east-1)
  4. An incident is created with this instance identifier stored
  5. When a recovery email arrives (e.g., [RESOLVED:1] Server Down | us-east-1), Siren matches it to the open incident
  6. The incident is automatically resolved with a system note indicating auto-resolution
From Address Filtering: You can optionally restrict a rule to only match emails from a specific sender address. This adds an extra layer of security if you want to ensure only your monitoring tool can trigger automatic resolution.
Recovery Without Alert: If a recovery signal arrives but no matching open incident exists, Siren records the signal but does not create an incident. This prevents unnecessary incidents when systems recover from issues that were never alerted.

Pricing

Siren offers a simple, usage-based pricing model. Every organization starts with a free tier to help you evaluate the service.

Free Tier

Every organization receives 25 free incidents. This allows you to fully evaluate Siren before committing to a paid plan. No credit card is required to get started.

Paid Plan

Once you've used your free incidents, you can add a payment method to continue using Siren.

Minimum Monthly Charge $10.00 / month
Per Incident $0.20 / incident

Each month, you are billed the greater of: (a) the minimum monthly charge, or (b) your total incident usage multiplied by the per-incident rate.

Price Guarantee: Prices are subject to change, but we will always honor the pricing you agreed to when you signed up for a paid account. Your agreed-upon rates are locked in at the time you add a payment method.

Services

Services represent the systems or applications you want to monitor. Each service has its own email address for receiving alerts and its own on-call rotation.

From the Services card you can:

  • Click the + icon to create a new service (just provide a name and description)
  • Click the gear icon on any service to view its on-call schedule and settings

Service Details

The Service Details page lets you:

  • Edit the service name and description
  • Copy the service ingestion email for configuring your monitoring tools
  • View and manage the on-call rotation
On-Call Rotation

The rotation shows who is currently primary and secondary on-call. A calendar view displays the full rotation schedule.

Rotation Options: Rotations can be configured to rotate daily or weekly. You select the time of day (on the hour or half-hour) when handoffs occur.

Team members rotate in the order shown on screen. The secondary on-call is always the person who was primary before the current primary. Think of it as: you're primary for your shift, then secondary for the next shift.

On-Call Overrides

Need to swap shifts? Click any future day on the calendar to create an override. Overrides let you temporarily assign a different team member to cover part of a scheduled shift.

  • Primary override – replaces the scheduled primary on-call
  • Secondary override – replaces the scheduled secondary on-call

Overrides are useful for vacations, appointments, or shift swaps between team members.

Members & Invites

To add team members, click the invite icon on the Members & Invites card:

  1. Enter their email address
  2. Select their role (Member, Admin, or Owner)
  3. Click Send Invite

The invitee receives a magic link via email. When they log in, they'll complete a simplified onboarding to enter their name and (optionally) phone number. Once complete, their status changes from Invite Pending to Active.

Incidents

Incident Ingestion

Incidents are created by sending emails to your service-specific Siren email address.

When Siren receives an email:

  • A signal is always created (the raw alert)
  • If an open incident exists with the same subject, the signal is aggregated to it
  • If no matching open incident exists, a new incident is created
Keep Your Service Email Private

Any email sent to this address creates signals, and you're billed per incident. Use it only for your monitoring tools, cron jobs, and automated alerting—not for general communication. If you need to share it externally, use a distribution list as an intermediary.

Incident Management

The Incidents page lists all incidents across your organization.

Filter by:

  • Status – All, Open, or Resolved
  • Service – narrow down to a specific service
  • Page size – control how many records appear

To create an incident manually, click the + icon. Select a service, enter a title and description, and the on-call team member will be paged immediately.

Click any incident's subject to view its details.

Incident Details

From the Incident Details page you can:

  • Acknowledge – confirm you're working on it (stops reminders)
  • Escalate – immediately page the secondary on-call
  • Close Incident – mark as resolved

The page shows timestamps for when the incident was created, acknowledged, and resolved. When closing, you'll be prompted to enter an incident summary describing what happened and how it was resolved.

Notes: System notes are added automatically as team members are paged. Anyone can add their own notes to document investigation progress or share context.

Signals: The Signals card shows the original email(s) that triggered the incident. Additional emails with the same subject are aggregated here while the incident remains open.

Deduplication

How deduplication works: Siren groups alerts by email subject. Multiple emails with the same subject are aggregated into a single incident (as long as it's still open). This prevents alert fatigue from flapping monitors or repeated notifications.

Alerting, Reminders & Escalations

When an incident is created, Siren identifies the service and pages the primary on-call team member. If no one acknowledges, Siren automatically escalates through the following timeline:

Time Action
0 min Initial page to primary on-call
2 min Reminder to primary (if not acknowledged)
5 min Escalate to secondary on-call
7 min Reminder to secondary (if not acknowledged)
15 min Give up: note added to incident, email sent to all organization owners

Acknowledging an incident stops the reminder/escalation timer. You can acknowledge via the Siren web interface or by responding to the phone call.

About the 15-minute notification: This email to owners is intended as a training opportunity to improve on-call responsiveness—not to assign blame.

User Settings

Access User Settings from the dropdown menu under your name in the navigation bar.

Phone Number

Add or update your phone number to receive alerts. Phone verification ensures we can reach you during incidents.

SMS Notifications

Incident alerts are always delivered via phone call. Optionally, you can opt-in to receive SMS notifications for:

  • On-call schedule reminders – know when your shift is starting
  • Other Siren events – non-urgent updates about your account
Pro tip for reliable alerting:
  • Save Siren's phone number in your contacts
  • Configure it to bypass Do Not Disturb (check your phone's emergency/priority contacts settings)
  • Set a distinctive, loud ringtone so you'll wake up for middle-of-the-night pages
Email notifications: Siren sends emails from [email protected]. This address is not monitored—do not reply to these emails.

Availability

We don't publish an SLA or uptime guarantee—we're not at that stage yet. But we take reliability seriously and live by the same standards we preach.

We monitor Siren using Grafana for metrics, traces, and logs. We have alerting configured and will respond to issues as quickly as possible.

Our priority is ensuring the highest reliability for the features that matter most:

  • Email ingestion – receiving alerts from your monitoring tools
  • Phone alerting – getting your team paged when incidents occur

If Siren is down or degraded, we'll work to restore service as quickly as we can.

Support

Siren is a low-cost service, and we don't offer extensive hands-on support. That said, we stand behind the product—the features documented here should work as described. If something isn't working correctly, we'll fix it.

For bugs, account issues, or questions:

To delete your account or request a copy of your data, email us at the address above.