Alerts

An alert is a current signal that needs attention. Alerts can represent device connectivity, monitor state, metric rules, or security activity. They carry severity, audience, status, and resource context.

Alerts and incidents are not interchangeable:

• Use an alert for a discrete condition that an operator can inspect and resolve.
• Use an incident when acknowledgement, escalation, delivery tracking, on-call ownership, or public communication is required.
• Use a log alert rule when a saved log query should call a webhook. Log rule grouping and throttling are separate from incident escalation.

Alert lifecycle

Alerts can be active, resolved, or expired depending on their source. A source heartbeat can refresh an existing alert rather than create duplicates. Recovery resolves an active connectivity or monitor alert when the evaluator observes enough successful samples.

Notification preferences decide which eligible product notifications a user receives. They do not replace access control, and they do not make every alert an incident.

Respond safely

1. Open the alert and identify its source, severity, device or scope, and first observed time.
2. Follow the resource link to its monitor or device.
3. Query logs for the same resource and time window.
4. Check whether the condition affects one device, a selected fleet, a service endpoint, or a customer journey.
5. Use remote shell or Wormhole only if investigation requires an interactive response.
6. Confirm the source has recovered before closing the alert; a successful command alone is not a recovery signal.

Related

• Monitors
• Incidents and on-call
• Search logs
• Respond to an incident