Edwin AI vs Dynatrace Davis AI vs Datadog Bits AI (2026)

Edwin AI is LogicMonitor's AIOps layer: it correlates alerts from LogicMonitor and third-party tools into "insights", then adds AI agents that investigate an insight and suggest or run a fix. Compared with Dynatrace Intelligence (formerly Davis AI) and Datadog Bits Investigation (formerly Bits AI SRE), its difference is where the evidence comes from: Edwin starts from correlated alerts plus CMDB and change records, Dynatrace from its own dependency graph, and Datadog from its own telemetry. LogicMonitor publishes a starting list price for the package that includes Edwin's event correlation ($53 per Hybrid Unit a month), but Edwin's AI Agents, which run the investigations, are an add-on with no published price (and not available on the entry package). If you want the investigation layer without a monitoring platform under it, the open source agents (Aurora, HolmesGPT) are the alternatives we have measured.

Arvo builds Aurora and wrote the lab scenarios cited below. We have not tested Edwin AI, Dynatrace or Datadog: their AI layers are hosted services we could only try in a vendor trial, and none publishes a test set a buyer can rerun. Every claim about them links the vendor's own pages, read on 2026-10-21.

What is Edwin AI and what does it do today?

Edwin AI is sold inside LogicMonitor's platform, in three parts listed on the pricing page: Event Intelligence, AI Agents and AI Automation.

Event intelligence (correlation). Edwin "ingests events and transforms them into contextualized insights": it deduplicates repeat events into one alert, then correlates, groups and prioritizes alerts into insights, which LogicMonitor says reduces noise "with up to 90-95% efficiency" (Introduction to Edwin AI). Correlation is model-based and configurable: each model has a dataset filter, the alert fields to compare, a string-based or list-based method, a similarity percentage and a minimum cluster density of at least 2 alerts (Edwin AI Models). ServiceNow CMDB data enriches alerts, and alerts can be reclustered when a better grouping appears.

AI Investigation (root cause). For an insight or a single alert, AI Investigation "analyzes alerts, metrics, logs, change requests, diagnostic and remediation source results and other available data" and returns a title, summary, most probable root cause, impact, timeline and suggested remediation split into "Immediate Fix" and "Preventative Actions". By default it runs automatically on critical and major insights; lower severities are triggered by hand. The docs say root causes "can be derived from alert data and available LogicMonitor log events, and ServiceNow Change Requests" for the impacted configuration items. It needs the AI Agents SKU (AI Investigation).

AI Agents (chat and orchestration). An orchestrator agent picks among specialized agents: IT Ops (triage steps and draft RCAs), Insights, Charts, Public Knowledge (vendor docs and known bugs), Metrics, Similar Insights, Similar Incidents, Private Knowledge Base and Change Request. The Similar, Private Knowledge Base and Change Request agents need the ServiceNow app (LMDX). The agents work on the events, alerts, insights and metadata Edwin has received (AI Agents overview, updated 2026-07-31). Agent Studio controls which agents are enabled and which MCP tools and integrations they may use, and its Agent Observability view shows each agent's data sources, tool activity and failed tool calls. A LogicMonitor MCP server exposes Edwin investigations to clients such as Cursor, Codex and Claude; "The current release is read-only" (MCP).

AI Automation (remediation). Edwin searches for existing Red Hat Ansible, Terraform and Rundeck workflows first; if none fits, "IBM watsonx Code Assistant turns Edwin's diagnosis into precise Ansible YAML", executed through Ansible Automation Platform "with approvals, rollback, and audit trails" (AI Automation). Separately, the core platform runs Groovy or PowerShell DiagnosticSources and RemediationSources, by hand or from Action Rules that match alert conditions, on collector-monitored resources (docs). LogicMonitor's AI governance page says "Every output is a recommendation" and that people "decide whether to permit autonomous action and remediation."

Integrations. The integrations list (updated 2026-10-19) names monitoring sources Catchpoint, Splunk, Datadog, AppDynamics, ThousandEyes, Dynatrace, Cribl, Elastic, Grafana, New Relic, SolarWinds and Nexthink; ITSM targets ServiceNow, Jira (Data Center and Service Management), MS Dynamics, PagerDuty, ConnectWise, xMatters, BMC Helix, BigPanda, Freshservice and Zendesk; automation through Ansible and Rundeck; Microsoft Teams; and a Python SDK. Several entries say "For documentation, please contact your CSM". Third-party tools send events: the Dynatrace integration, for example, is a Dynatrace problem webhook posting to Edwin's event endpoint. So Edwin can sit on top of Dynatrace or Datadog as a correlation layer, but it receives their problems and alerts, not their traces.

Hybrid and on-prem coverage. LogicMonitor's collector "runs on a Linux or Windows server within your infrastructure", polls devices with standard protocols, and sends the data "back to the LogicMonitor servers over an outgoing SSL connection" (collector docs). That is LogicMonitor's strength: network gear, servers, storage and wireless on-prem, plus cloud, under one license unit. Edwin itself runs in LogicMonitor's cloud: collectors send to LogicMonitor's servers, and third-party tools post events to Edwin's endpoint. We found no self-hosted or on-prem Edwin option in LogicMonitor's docs or pricing page.

Models. LogicMonitor announced a "strategic collaboration" with OpenAI in March 2025 that brings OpenAI's reasoning and natural-language capabilities into Edwin, for contextualizing alerts, explaining root-cause findings and generating suggested actions (LogicMonitor blog). Its governance page says customer data "is not used to train third-party LLMs", PII fields can be excluded, and model upgrades pass "structured offline evaluation against a benchmark suite". The Agent Studio page mentions "model flexibility" and work with OpenAI, IBM Red Hat and AWS, but we found no documentation of choosing a model or bringing your own, and the benchmark results are not published.

LogicMonitor's own outcome figures (a "313% ROI" Forrester TEI study it commissioned, customer quotes on noise cut) are on the Edwin AI page. We found no published root-cause accuracy figure.

How is Edwin AI priced and licensed?

From the LogicMonitor pricing page on 2026-10-21. Prices are "starting monthly list pricing based on standard minimum quantities and terms", in USD.

Package	List price	Edwin Event Intelligence	Edwin AI Agents (includes AI Investigation)	Edwin AI Automation
Essentials	$16 per Hybrid Unit	Not available	Not available	Not available
Advanced	$27 per Hybrid Unit	Add-on	Add-on	Add-on
Signature + Edwin AI	$53 per Hybrid Unit	Included	Add-on	Add-on

• The unit. "One Hybrid Unit is equivalent to one on-prem collector monitored device, one cloud IaaS, seven cloud PaaS, five wireless access points, or 100 gigabytes of OpenTelemetry metrics." Essentials stops at 999 Hybrid Units.
• Quote-only. No add-on has a published price, so AI Agents and AI Automation are quote-only on Advanced and Signature + Edwin AI (Essentials does not offer them), and Event Intelligence is quote-only on Advanced. The agentic investigation that this page compares with Dynatrace and Datadog is therefore not priced publicly anywhere. Discounts "Potentially, yes", through the account team.
• Trial. The pricing page says "Try any plan free for 15 days"; the site navigation elsewhere offers "14-day access to the full LogicMonitor platform".
• Our arithmetic, not LogicMonitor's figure: Signature + Edwin AI lists $26 a month more per Hybrid Unit than Advanced. That gap also buys other Signature features, so it is not Edwin's price. At list, 500 on-prem devices on Signature + Edwin AI is $26,500 a month before the AI Agents add-on.

Edwin is not sold as a standalone product on that page: it is licensed per monitored resource as part of a LogicMonitor package, and third-party sources feed it through integrations.

Edwin AI vs Dynatrace Davis AI vs Datadog Bits AI: root-cause evidence, remediation and hybrid coverage

How they compare on root-cause evidence, remediation and hybrid coverage, from each vendor's docs and pricing pages on 2026-10-21. We have run none of them.

	Edwin AI (LogicMonitor)	Dynatrace Intelligence (formerly Davis AI)	Datadog Bits Investigation (formerly Bits AI SRE)
Starts from	Correlated alerts ("insights") and singleton alerts; auto-investigates critical and major ones	Problems Dynatrace detects; agentic tasks from Dynatrace Assist, workflows, MCP or the API	A Datadog monitor alert, Synthetic test, RUM or a free-text prompt
Root-cause evidence	Alerts, metrics, LogicMonitor logs, ServiceNow change requests, diagnostic and remediation source results; CMDB data enriches the alerts (docs)	"Deterministic, causation-based analysis" over the Smartscape dependency graph and Grail data, with code, deployment and configuration changes (docs)	Iterative hypotheses tested against Datadog metrics, traces, logs, Change Tracking, GitHub source code (docs)
Remediation	Suggested fix and preventive steps; AI Automation finds or generates Ansible playbooks and runs them with approvals	Proposes fixes or rollbacks through agentic workflows, in Preview; runs approved runbooks	Triage actions (Slack, Teams, paging, Jira); rollbacks through Datadog Workflows (blog)
Hybrid and on-prem	On-prem devices through collectors; Edwin itself is hosted	Dynatrace Managed runs on-prem, but its agentic and generative AI "is not available for Dynatrace Managed customers" (FAQ)	Bits runs in Datadog's SaaS; not available to FedRAMP customers (docs)
Third-party data	Events from Datadog, Dynatrace, Splunk, Grafana, New Relic and more, plus ITSM	Data ingested into Dynatrace	Grafana, Dynatrace, Sentry, Splunk, ServiceNow, Confluence, all "in Preview"
Price of an investigation	Not published (AI Agents add-on)	30 AI units average at $0.10 a unit: about $3 by our arithmetic; not billed inside Dynatrace Assist "for a limited time" (pricing)	About 6.5 AI credits; $1 to $1.30 a credit, so about $6.50 to $8.45 by our arithmetic (pricing)
Data you must have	LogicMonitor monitoring or third-party events sent to Edwin; ServiceNow for several agents	Dynatrace monitoring (OneAgent, cloud integrations) on Dynatrace SaaS	Datadog monitors and telemetry
Public accuracy test	None	None	None (internal eval platform described, scores not published)

The short version: Dynatrace's root cause is the most structured, because it walks a dependency model it built itself; Datadog's is the most investigative inside its own data; Edwin's is the broadest in sources, because it is a correlation layer that takes events from other tools, but its evidence for those sources is the event, not the underlying telemetry. That makes Edwin strongest where the problem is alert volume across many tools and a ServiceNow process, and weakest where the cause hides in data that never raised an alert.

When does each one fit?

• Edwin AI fits a hybrid IT estate (on-prem devices and network gear, wireless, cloud) already monitored by LogicMonitor or by several tools, run through ServiceNow, where the first problem is too many alerts.
• Dynatrace Intelligence fits teams whose applications run under OneAgent on Dynatrace SaaS and who want root cause tied to service topology. On Dynatrace Managed you keep the deterministic RCA but not the agentic layer.
• Datadog Bits Investigation fits teams whose telemetry is all in Datadog and whose alert volume makes about 6.5 credits per investigation acceptable. See our Datadog Bits AI alternatives page for the credit arithmetic.
• None of them fits a team that needs the investigation agent itself in its own network, wants to choose the model, or does not want to buy a monitoring platform to get an investigator. That is where the open source agents come in.

What are the alternatives to Edwin AI?

Checked against each project's or vendor's site on 2026-10-21.

Tool	What it is	Reads LogicMonitor	Runs where	Price	Lab-tested by us
Aurora	Open source agent that investigates each incoming alert	No connector; ingests PagerDuty, Datadog, Grafana, New Relic, OpsGenie, incident.io, Dynatrace and more	Docker Compose, Helm, air-tight bundle	Free, Apache 2.0; you pay hosting and model calls	Yes
HolmesGPT	Open source investigation agent with toolsets	No built-in toolset (list checked 2026-10-21); has Datadog, New Relic, Prometheus, ServiceNow and others, and connects to remote MCP servers, so LogicMonitor's read-only MCP server is a possible route we have not tried	CLI, server, Kubernetes	Free, Apache 2.0; you pay model calls	Yes
K8sGPT	Open source Kubernetes scanner with LLM explanations	No	CLI, in-cluster operator	Free, Apache 2.0	Yes, as a scanner
Dynatrace Intelligence	Platform RCA plus agentic investigation	No LogicMonitor integration found	Dynatrace SaaS for the agentic part	AI units, see above	No
Datadog Bits Investigation	Investigation agent over Datadog data	Not in its documented sources	Datadog SaaS	AI credits, see above	No
BigPanda	Alert correlation platform with an investigation swarm	Edwin lists BigPanda as an ITSM target; we did not check the reverse	SaaS, EU instance	Credit plans, no dollar figures	No

For the correlation-first products in this category, see BigPanda alternatives and Moogsoft (Dell APEX AIOps) alternatives; for hosted AI SRE agents (Traversal, Resolve AI, Cleric and others), AI incident investigation tools compared; for pricing across the category, AIOps platforms with root cause analysis.

An open source agent is not a drop-in replacement for Edwin. Aurora's correlation engine links related alerts into the running investigation but never suppresses or mutes them, so it does not do Edwin's noise reduction, and it does not monitor devices. It replaces the investigation step, not the monitoring or the event pipeline. If LogicMonitor stays, the open question is how its alerts reach the agent; Aurora has no LogicMonitor connector today.

How did the open source alternatives do in our lab?

This is the part we measured. The lab is a small app (nginx frontend, Python api, worker, redis, load generator) on a 3-node kind v0.33.0 cluster with Kubernetes v1.37.0. One fault is injected per scenario (two in scenario 12), 19 scenarios, two runs each. Aurora and HolmesGPT get the alert; K8sGPT takes no alert and scans the namespace. All three got the same admin kubeconfig, each behind its own guard: Aurora's observability-only command policy, HolmesGPT's allow-list, K8sGPT's read-only analyze. Aurora (commit 87d22baf, on bedrock/us.anthropic.claude-sonnet-5) ran on 2026-10-02; HolmesGPT 0.43.0 (same model) and K8sGPT 0.4.40 ran on 2026-10-15 and 2026-10-16, on the same cluster and faults; K8sGPT used us.anthropic.claude-sonnet-4-5 because it sends a temperature setting that Bedrock rejects for Sonnet 5. There is no LogicMonitor, Dynatrace or Datadog in the lab: the agents read the cluster directly.

	Aurora	HolmesGPT	K8sGPT
Correct	34 of 38	31 of 38	not scored as a peer
Partial	4	6	21
Wrong	0	1	5
"No problems detected"	0	0	12 runs (6 scenarios)
Median time per run	153.5 s	45 s	12.5 s for two analyze passes
Model cost per run	$0.19 to $0.84, median $0.35	not captured	not reported
Who confirmed the grades	a person at Arvo	judge model only	judge model only

A judge model (us.anthropic.claude-opus-5-5) graded every answer. A person at Arvo read all 38 Aurora grades and changed none. The 76 HolmesGPT and K8sGPT grades are judge-model only: a second model re-read all 76 and agreed, a third pass graded them from scratch and agreed on all 38 HolmesGPT verdicts while disputing 6 K8sGPT labels, and no person has checked them. A blinded regrade, with tool names removed from the judge's prompt, matched the published verdict in 38 of 38 Aurora runs, 37 of 38 HolmesGPT runs and 36 of 38 K8sGPT runs. The prompts differ in wording, and HolmesGPT ran holmes ask with default toolsets. A two-sided Fisher exact test on the totals, computed on /benchmark, gives p = 0.52 for Aurora against HolmesGPT, comparing human-read Aurora grades with judge-only HolmesGPT grades: treat the two as roughly even on accuracy. HolmesGPT is about 3x faster at the median.

What the cost line leaves out: Aurora's background discovery job cost about $1 per cluster connection in the lab ($29.70 for 30 completed runs, about twice the $14.53 of the 38 graded investigations), plus your own hosting. HolmesGPT's log says the model "has no entry in litellm's cost map", so its cost was recorded as $0.

K8sGPT is a different kind of tool. It runs analyzers over a namespace and explains what they flag, without an alert. In 12 runs it printed "No problems detected", on faults such as a NetworkPolicy block or a slow memory leak where every object looks healthy. Use it as a scanner, not an investigator.

The miss that matters for correlation-first tools

Edwin, Dynatrace, Datadog, Aurora and HolmesGPT all start from an alert or a problem. Scenario 12 shows the limit of that design: a worker OOMKilled fires the alert while, separately, the frontend Service selects no pods. Both agents found the OOM in both runs, and neither reported the frontend outage. Aurora went further and stated the opposite:

Other workloads in the shop namespace (api, frontend) remained healthy and unaffected [5, 14].

Pod status was its only evidence. Alert correlation does not fix this: it can only group alerts that fired, and a fault no monitor covers never enters the stream. Whatever you buy, test it on a second fault the alert does not mention; the checks are in the runbook a second fault the alert does not cover.

How to trial Edwin AI, Dynatrace or Datadog against the same faults

LogicMonitor's pricing page and Dynatrace offer 15-day trials, and Datadog a 14-day trial. None of them publishes a test set, so bring your own. Each scenario in Arvo-AI/aurora-lab has the alert, the true root cause and the findings a correct answer must contain.

git clone https://github.com/Arvo-AI/aurora-lab && cd aurora-lab
./lab.sh up
./lab.sh break 12-two-faults-oom-and-selector

The cluster has to report to the trial you are testing, since each product works from its own data: a LogicMonitor collector, a Dynatrace OneAgent or a Datadog Agent. Build the alert in that product yourself, let it investigate, grade the answer against must_identify in the scenario's scenario.yaml, then ./lab.sh reset. Run every scenario twice, as we did, and keep the misses. For a single failure on your own cluster, use /diagnose.

What the lab does not tell you

The lab is Kubernetes-only and synthetic, with faults Arvo wrote. Edwin's strengths are elsewhere: on-prem devices, network gear and ServiceNow process, none of which the lab touches, and it says nothing about alert-noise reduction at volume. HolmesGPT 0.44 and 0.45 were already out when we ran 0.43.0; those versions are untested. Vendor packaging changes often (Dynatrace's Davis AI and Datadog's Bits AI SRE URLs now redirect to Dynatrace Intelligence and Bits Investigation), so recheck the pricing pages before you sign.

Verified 2026-10-21: LogicMonitor pricing, Edwin AI product pages, Edwin AI docs and governance page; Dynatrace docs, FAQ and pricing; Datadog pricing and docs, as linked. Lab numbers from results.json; full method in the Aurora lab report and Aurora vs HolmesGPT vs K8sGPT. See also Dynatrace Davis alternatives.

Aurora is on GitHub under Apache 2.0, or book a demo to run it on your own alerts.