Alert Triage

Triage is the loop you run when the queue fills up: find what matters, acknowledge what you're taking, snooze or close the noise, and escalate what you can't handle. Everything here works identically in the admin console and the mobile app.

1. Cut the list down to what matters

   The Alerts page opens on everything. Use the status chips to show only Open — that's your work queue. Acknowledged is work in progress, Closed is history. The search box does full-text filtering across alert messages, sources, and tags, so payments or P1 narrows instantly.

   Tip

   During an incident, filter to Open and sort by severity: work P1s first, batch the rest. A queue you can't see the top of is a queue you'll lose alerts in.

2. Act on many alerts at once

   Tick the checkbox on any row and the bulk action bar appears at the top of the list. Select as many alerts as you need — every action in the bar applies to all of them.

   

   The bar offers four actions: acknowledge, close, snooze (presets from 15 minutes to 4 hours), and assign to a user. Bulk ack is the standard "I've seen the flood, I'm on it" move; bulk close is for clearing noise after the root cause is fixed.

   

3. Work a single alert through its lifecycle

   Click any alert to open its detail page. This is where real triage happens: severity banner, full description, metadata, the action bar, and the activity timeline that records everything anyone does to the alert.

   

   The lifecycle, in the order you'll usually run it:

   • Acknowledge — stops escalation and tells the team someone owns it. Ack is a statement, not a fix.
   • Note — add context for the next person: what you checked, what you suspect, links to dashboards. Notes land in the timeline.
   • Assign — hand the alert to a specific user when it's theirs to fix. They get notified.
   • Snooze — silence a known-benign alert for a preset window (15m, 30m, 1h, 4h). It reopens automatically when the window ends. Snooze is offered on open alerts; once an alert is acknowledged, the action bar shows Unacknowledge in its place.
   • Close — resolved or not actionable. Closed alerts stay searchable in the list.
   Warning

   Snooze is not close. A snoozed alert comes back — if you snooze a real problem four times in a row, you've lost two hours. Snooze noise; work or escalate everything else.

4. Escalate when it's over your head

   The Escalate action on the detail page pushes the alert to the next level of its escalation policy immediately — you don't wait for the timeout. Use it when you've confirmed the problem is real and not yours. Declare incident, next to it, promotes the alert into a tracked incident with responders and a status timeline (covered in Incidents & services).

   Note

   Escalation targets come from the alert's escalation policy. If no policy is attached, manual escalation has nowhere to go — set policies up in Schedules & escalations.

5. Triage from your phone

   The mobile app mirrors the same lifecycle. The Alerts tab has the same filter pills and alert cards; swipe a card for the quick actions you'll use most. Tap through to the detail for the full timeline and the floating action bar: acknowledge, snooze, note, assign, escalate, close.

   

   

   Acking from mobile is the most important action in the product: it's what stops the escalation chain at 3 a.m. Everything else can wait for a keyboard.

6. Read the timeline — it's your receipt

   Every action on an alert — created, acknowledged, snoozed, noted, assigned, escalated, closed — lands in the activity timeline with the actor and a timestamp. That timeline is your audit trail and your read receipt in one: when you ack an alert, everyone else can see you did, and when someone else acks, you can stop worrying about it.

   Tip

   Before you close an alert someone else acknowledged, read their notes in the timeline first. If they wrote "deploying fix," closing it under them loses the record that the fix worked.