Alerts

Your workspace can watch for trouble on its own. Events arrive from your monitoring tools or from an assistant that noticed something during a run. A triage step reads each one and decides whether anyone needs to know, how urgent it is, and who should hear about it. What it keeps becomes an alert in the Alerts tab, and the right people are notified.

Where events come from

• Your tools, through a source. In Settings → Workspace → Alerts, the workspace owner adds a source, for example grafana. You get a URL with a secret in it: copy it straight away, because it is shown only once. Point your monitoring tool’s webhook at it. If the URL leaks, choose New token and the old one stops working at once. Turn off pauses a source.
• Your assistants. An assistant with the raise_alert tool attached can flag something it noticed while working, such as a data feed that went stale or a competitor’s price that changed. Its flag goes through the same triage as everything else.

A source accepts a JSON POST with a subject, a body and an optional external_id. If your tool sends the same external_id twice (a retry), the second one is ignored, so a flaky connection does not count as two events. Very long messages are shortened rather than refused. Your tool may also send occurred_at (when it happened), a payload object with extra detail, and a locale (such as fr) that sets the language the alert is written in.

What the triage decides

For every event the triage answers four questions:

1. Is it worth telling someone? Heartbeats, test messages and repeats of something already open usually are not.
2. How severe is it? Low, Medium, High or Urgent.
3. Who should hear about it? It routes by role or responsibility, using what your workspace profile says about its people. If nobody matches, the workspace owners get it, and the alert says so.
4. Is it the same thing as an open alert? Then it is added to that alert instead of creating a new one. The alert counts how often it was seen. You are notified again only if it got more severe.

The triage writes the alert’s headline and summary in the language the source sent (its locale), or in English when it sent none.

Tuning it

The triage is an agent like the others, so you tune it in Settings → Agents → Triage. Add instructions in plain words, for example “A line move of 3 points or more on an NHL game is high severity; route it to the traders”, or choose a different model. Changes apply to the next event.

Working an alert

Open the Alerts tab. Alerts are grouped by severity, most severe first. Turn on Routed to me to see only yours. Select an alert to see what happened, who it went to, and every event filed under it. From there:

Action	What it does
Acknowledge	Says you have it.
Snooze	Hides it for an hour, four hours, a day or a week. It comes back on its own.
Resolve — useful / Resolve — noise	Closes it. Your verdict helps the triage: it is shown the alerts your workspace called noise, and leans away from their like.
Mute…	Closes it as noise and stops alerts like it: this exact alert, one of its topics, or everything from its source, until a date you pick or until someone lifts the mute.

A noise verdict alone never mutes anything. Muting is always something a person chose to do. Mutes are listed in Settings → Workspace → Alerts, where whoever added one, or the workspace owner, can lift it.

Show held back adds what the triage decided not to tell you, with the reason: it matched a mute, an open alert already covered it, or it was not worth a notification. Use it to check the triage is not being too strict.

How you are notified

Alerts reach you through your usual channels: email, SMS or Slack, as set in Settings → Notifications. The An alert was raised row has a Minimum severity for each channel. The default is Medium: low alerts stay in the Alerts tab without notifying you. You might set Slack to Low and SMS to Urgent, for example.

You are notified once per alert at each severity it reaches. Repeats at the same severity and snoozes ending do not notify you again.

Good to know

• Alerts belong to the workspace. Every member can see and work them. Only the workspace owner manages sources.
• If the workspace’s subscription has lapsed, sources stop accepting events and nothing is triaged until there is an active plan again.
• Each triage is one model call, billed to your workspace as usage. Events held back by a source mute are not sent to the model, so they cost nothing. See Usage and billing.
• Your organisation can turn Alerts off. The tab and the settings section then disappear.