Alerts
Alerts are notifications generated by monitoring systems, integrations, or manual submissions. They are routed to on-call responders based on schedules and escalation policies.
Alert lifecycle
Every alert goes through a defined set of statuses:
Pending → Acknowledged
↓
Escalated| Status | Description |
|---|---|
| Pending | Alert has been created and routed to a responder. Waiting for acknowledgment. |
| Acknowledged | A responder has claimed the alert and is actively working on it. |
| Escalated | The acknowledgment timeout expired. Alert was forwarded to the next escalation target. |
INFO
An alert can move from Acknowledged back to Pending if the assigned responder explicitly unassigns themselves.
Acknowledging alerts
Single acknowledgment
Click the Acknowledge button on an alert to take ownership. The alert stops escalating and is assigned to you. Other team members see that the alert is being handled.
Bulk acknowledgment
When multiple alerts fire simultaneously (e.g., during a cascading failure), use bulk actions to acknowledge them at once:
- Select the alerts using the checkbox column.
- Click Bulk Acknowledge.
- Confirm the action.
All selected alerts move to Acknowledged status and are assigned to you.
WARNING
Only acknowledge alerts you intend to work on. Bulk-acknowledging alerts without resolving them creates noise and makes it harder for the team to track real progress.
Severity-based routing
Alerts carry a severity level that influences how they are routed and how quickly they must be acknowledged:
| Severity | Typical timeout |
|---|---|
| Critical (SEV1) | 5 minutes |
| Warning (SEV2) | 15 minutes |
| Info (SEV3) | 60 minutes |
These timeouts are configured in the escalation policy attached to the alert's schedule.
Alert detail page
Each alert has a detail page showing:
- Timeline -- all status changes, acknowledgments, and escalations with timestamps.
- Assigned responder -- who is currently responsible.
- Incident type -- the category (SEV1, SEV2, SEV3, or custom).
- Linked incidents -- any incidents created from this alert.
Use the timeline during incident reviews to reconstruct the response sequence.