The alerts table allows you to view and sort alerts according to your preferences, helping you locate what you're looking for quickly and efficiently.

🚧

Required User Permissions

The alerts table only shows alerts from services that you have access to. The visible alerts may be restricted by your Base Role, Team Role or Object Role. If you would like permission to view alerts from a specific service, please reach out to the appropriate Team Manager, Global Admin or Account Owner to grant access.

When using Event Orchestration, if you suppress alerts and do not route them to a service, those alerts will only be visible to administrators.

View the Alerts Table

Navigate to the alerts table in the web app by selecting Incidents Alerts.

By default, the alerts table displays alerts from the Last 30 days. You can adjust the time range:

1. On the alerts table, find the Created column and click to the right.

2. Select one of the following options:
   • All time
   • Last hour
   • Last 24 hours
   • Last 7 days
   • Last 30 days
3. Click Apply.

If you have sufficient permissions and the alerts table is not visible, it could be because no services have alerts enabled. For more information, see the section Enable Alerts.

Alerts Table Columns

Alerts are filtered via the columns that appear in the alerts table. The type of filter (radio button or search) varies based on column data type.

The columns Severity, Summary, Source, Class, Component and Group all map to Common Event Format (PD-CEF) fields, which can be included in your events with our Events API v2.

The Status column indicates whether your alerts are triggered, resolved, suppressed, or suspended. Created indicates the date and time the alert was created.

Incident Title points to the incident your alerts are grouped under, and Service and Integration point to the service and integration your alerts are associated with.

Show and Hide Columns

Customize Columns lets you show or hide the Incident Title, Service, Integration, Source, Class, Component and Group columns. The Status, Severity, Summary and Created columns cannot be disabled and are grayed out in the Customize Columns menu.

Incident Title, Service, Integration and Source are automatically enabled, but can be hidden.

Search Filtering

Search filtering is enabled on the Summary, Incident Title, Integration, Source, Class, Component and Group columns. Partial matches will be displayed, for example searching Prod will display prod04 and Prod03 in the results.

Sort Filtering

You can sort a majority of the columns. The default sort setting is by Status (Triggered, Triggered Suppressed, Resolved, Resolved Suppressed, or Suspended). Sortable columns will have a pair of arrows to the right of the column name. Click on the arrows to sort your alerts based on this column. The active sort filter appears in a darker gray than surrounding columns.

Active Filters Bar

The active filters bar at the top of the alerts table keeps track of which filters are enabled. Column tags populate the bar, and filter icons highlight blue when filters are active.

Here, for example, the alerts table has active Severity and Status filters:

Clear Table Filters

Table filters can be cleared from within the Active Filters Bar by clicking next to each individual filter, or by clicking Clear all table filters. You may also remove a search filter by clicking the search icon a second time and selecting Clear filter.

Alert Actions

You may perform actions on alerts that have been triggered, triggered (suppressed) and suspended.

Triggered Alerts

Triggered alerts, or triggered alerts that have been suppressed, can be resolved by checking the checkbox to the left of the alert and clicking Resolve.

Suspended Alerts

You can configure Event Orchestration to generate Suspended alerts, which will not immediately trigger an incident or send out responder notifications. These alerts can either be triggered or resolved by checking the checkbox to the left of the alert and clicking Trigger or Resolve. For more information, please read Event Orchestration: Pause Incident Notifications.