Alert

ℹ️
Private preview
Composable dashboards and the metrics API are in private preview: available to invited accounts, and features may change. See Integration and feature lifecycles for what this means, and reach out to your account representative to request access.

Overview

An issue a monitor raised, grouping one or more events. Group by it to list alerts.

Alert is what the product shows. Internally, and so in the API, an alert is called an incident: its dimensions start with incident__ and its metrics with incident_. What the product calls an Incident is an alert a user declared (incident__is_incident_declared).

Used by the metrics of: Data quality

Dimensions

Group by or filter on these names; all dimensions: Dimensions.

Dimension	Description
`incident__incident_created_at`	When the alert was created (UTC).
`incident__incident_first_feedback_at`	When the first status was set (UTC); empty when no status was set.
`incident__incident_first_feedback_hours`	Empty when no status was set. Time to response: hours from alert creation to its first status, of any kind. In the product: the Time to response card (Activity) and Time to response (alerts) card (Data operations) count only Acknowledged, Expected and No action needed, else the latest status, so their numbers differ. In the API: `incident_average_first_feedback_hours`, `incident_median_first_feedback_hours`.
`incident__incident_name`	Name a user gave the alert; empty for almost every alert. To tell alerts apart, use the monitor's name (`monitor__monitor_name`) and the table: `asset_incident_count` grouped by `incident` and `asset`. In the product: the alert list shows a title built from the monitor and the table instead.
`incident__incident_owner`	Owner (user) assigned to the alert.
`incident__incident_priority`	Inherited from the monitor; empty when not set. Priority: P1 (highest) to P5, the monitor's default for its alerts; an alert merged from several takes the highest. In the product: No priority when not set. In the API: `monitor__monitor_priority`.
`incident__incident_resolved_at`	When the last, terminal status was set (UTC); empty while the alert is open.
`incident__incident_status`	Last status set on the alert: investigating (shown as Acknowledged), work_in_progress, fixed, expected, no_action_needed, false_positive (deprecated); empty when no status was set.
`incident__incident_system_severity`	Legacy severity from the monitor configuration at creation; empty for most alerts. The severity users set is `incident__incident_user_severity`. In the product: not shown; priority is shown instead.
`incident__incident_ttr_hours`	Time to fixed: hours from alert creation to the Fixed status; also called time to resolution (TTR). Only alerts whose first or latest status is Fixed have it. In the API: `incident_average_ttr_hours`, `incident_median_ttr_hours`.
`incident__incident_type`	Internal type of the alert (anomalies, custom_rule_anomalies, ...); not the alert type of the product: use `incident_sub_type__incident_alert_type` for that. In the product: not shown.
`incident__incident_user_severity`	Empty when the alert was not declared an incident. Incident (declared): an alert a user marked as an incident and gave a severity, SEV-1 (most critical) to SEV-4. In the product: Incident. In the API: `incident__is_incident_declared`, `incident__incident_user_severity`. In the product: No severity when empty.
`incident__is_incident_declared`	Filter any alert metric on it to count declared incidents, e.g. per data product. Incident (declared): an alert a user marked as an incident and gave a severity, SEV-1 (most critical) to SEV-4. In the product: Incident. In the API: `incident__is_incident_declared`, `incident__incident_user_severity`.
`incident__is_incident_merged`	The alert was merged into another alert; it keeps no status of its own. In the product: merged alerts are not listed.
`incident__is_incident_open`	No terminal status yet (fixed, expected, no action needed, false positive).
`incident__is_incident_rule_run_error`	The alert was raised because a monitor failed to run. Monitor failed to run: the monitor itself could not execute (timeout, permissions, missing table). These are left out of alert counts and counted on their own. In the product: the Error status on the Monitors page. In the product: the Alert type filter of the Alerts page does not list these.
`incident__is_incident_status_set`	The alert has a status.

Updated 1 day ago

Did this page help you?