Alerts

A monitor opens an alert when it detects behavior outside the expected range: a sharp drop in transaction volume, an abnormal increase in errors or the crossing of a manually configured threshold. The alert is the record of that risk or anomaly event and requires attention.

Lifecycle

An alert is born open and remains open while the anomalous behavior persists. The platform closes the alert automatically and records the cause.

State	Description
Open	The detection rules are still being satisfied
Normalised	The values returned to the expected pattern for the number of consecutive measurements configured on the monitor
Expired	The alert exceeded the maximum time without normalising
Disabled	The associated monitor was deactivated or removed

The normalisation and expiration deadlines per interval are listed in limits and parameters.

Alert source

Each alert is linked to a monitor and reflects the detection rules configured on it:

• Anomaly: the machine learning model identified a significant deviation from the historical pattern.
• Condition: the aggregation value exceeded a manually defined threshold.

With both methods enabled, the alert is opened only when both are satisfied in the same measurement.

The alert records the observed value at the time of detection. The expected band and the direction of the deviation, high or low, are recorded only when anomaly detection takes part in the opening. In an alert originating from conditions alone, those two fields are empty.

Notifications

If the monitor has a notification channel configured, the platform sends a notification as soon as the alert is opened. Closing generates no notification by default.

Without a configured channel, alerts appear only in the admin panel.

Visualization

Open alerts appear in the panel, linked to the corresponding monitor. The screen displays:

• the period during which the alert was active;
• the observed value that triggered the detection;
• the metric chart with the alert interval highlighted.

Ratings

Each alert accepts a rating from the recipient, Helpful or Not helpful. The rating appears on the alert page, in the expanded row of the list and in the Slack notification.

A negative rating requires a reason and accepts an additional comment. The reasons are Normal variation, Already knew the cause, Number looks wrong, Repeated, Not relevant to me, Not actionable and Other.

The record is individual and also covers recipients who follow alerts on Slack without being platform users. Each recipient sees only their own rating and can change it at any time. The Slack message identifies who rated the alert, under Rated by, without exposing each person’s response.

The Glass Data team uses the ratings to understand what works and, when necessary, to recommend adjustments to monitors. A rating triggers no automatic action.

Relationship with metrics and monitors

The alert is the final result of the platform’s analysis chain:

• the metric aggregates events into time series;
• the monitor observes those series at regular intervals;
• the alert is opened when the detection rules are satisfied.

A single monitor can generate several alerts over time. Each cycle that begins and ends generates an independent alert.