# Alerts

An alert is the record generated when a monitor detects behavior outside the expected range. It represents a risk or anomaly event that requires attention — such as a sharp drop in transaction volume, an abnormal increase in errors, or the crossing of a manually configured threshold.

## Lifecycle

An alert is born open and remains in that state while the anomalous behavior persists. When the metric values return to the expected pattern, the alert is automatically closed.

| State | Description |
|-------|-------------|
| **Open** | Anomaly or condition still active |
| **Closed** | Behavior returned to normal |

Alerts are also automatically closed when the associated monitor is deactivated or removed.

## Alert source

Each alert is linked to a specific monitor and indicates which detection rule was triggered:

* **Anomaly**: the machine learning model identified a significant deviation from the historical pattern.
* **Condition**: the aggregation value exceeded a manually defined threshold.

The alert includes the observed value at the time of detection and the direction of the deviation — high, low, or both, as configured in the monitor.

## Notifications

If the monitor has a notification channel configured, the platform sends a notification as soon as the alert is opened. There is no closure notification by default.

If no channel is configured, alerts are only available in the admin panel.

## Visualization

Open alerts appear in the panel linked to the corresponding monitor. You can view:

* the period during which the alert was active;
* the observed value that triggered the detection;
* the metric chart with the alert interval highlighted.

## Relationship with metrics and monitors

The alert is the final result of the platform's analysis chain:

* the **metric** aggregates events into time series;
* the **monitor** observes those series at regular intervals;
* the **alert** is opened when a rule is triggered.

A single monitor can generate multiple alerts over time — each anomaly cycle that begins and ends generates an independent alert.