Alerts
An alert is the record generated when a monitor detects behavior outside the expected range. It represents a risk or anomaly event that requires attention, such as a sharp drop in transaction volume, an abnormal increase in errors, or the crossing of a manually configured threshold.
Lifecycle
An alert is born open and remains in that state while the anomalous behavior persists. Closing is automatic and records the cause:
| State | Description |
|---|---|
| Open | The detection rules are still being satisfied |
| Normalised | The values returned to the expected pattern for the number of consecutive measurements configured on the monitor |
| Expired | The alert exceeded the maximum time without normalising |
| Disabled | The associated monitor was deactivated or removed |
The normalisation and expiration deadlines per interval are listed in limits and parameters.
Alert source
Each alert is linked to a specific monitor and reflects the detection rules configured on it:
- Anomaly: the machine learning model identified a significant deviation from the historical pattern.
- Condition: the aggregation value exceeded a manually defined threshold.
With both methods enabled, the alert is opened only when both are satisfied in the same measurement.
The alert includes the observed value at the time of detection. The expected band and the direction of the deviation (high or low) are recorded only when anomaly detection takes part in the opening; in alerts originating from conditions alone, those fields are empty.
Notifications
If the monitor has a notification channel configured, the platform sends a notification as soon as the alert is opened. There is no closure notification by default.
If no channel is configured, alerts are only available in the admin panel.
Visualization
Open alerts appear in the panel linked to the corresponding monitor. You can view:
- the period during which the alert was active;
- the observed value that triggered the detection;
- the metric chart with the alert interval highlighted.
Relationship with metrics and monitors
The alert is the final result of the platform’s analysis chain:
- the metric aggregates events into time series;
- the monitor observes those series at regular intervals;
- the alert is opened when the detection rules are satisfied.
A single monitor can generate multiple alerts over time: each cycle that begins and ends generates an independent alert.