Alert Records

Last updated on 19 March, 2024

An alert is created when the Create Alert action runs in response to an automatic rule firing. The Create Alert action creates a new alert record and copies the event fields from the triggering record to the alert.

Alert Record Format

The alert field definitions are described in the following:

_idThe ID of the database record.
CIThe configuration item for which the event is being reported for example a server or router hostname.
DescriptionA short summary of the alert.
DetailsA verbose summary of the event.
NameThe name of the event reported, for example, Low Disk Space or High CPU Utilization.
SourceThe monitoring/management tool, application, log or API from which the event was generated.
Tenant IDLM Tenant Identifier
#EventsNumber of deduplicated events
EscalationThe state represents the lifecycle of an alert record from new to closed.
TimestampTimestamp of the event that created the alert.
First TimestampEarliest event within the deduplicated events.
Insight Key ListA list of correlated insights the alert belongs to.
Last Event TimestampLatest event within the deduplicated events.
Permanent URLURL to the alert ID
SeverityThe severity of the recent event.
Highest SeverityThe highest severity event contained within the alert’s deduplicated event set.
Lowest SeverityThe lowest severity event contained within the alert’s deduplicated event set.
StateThe state of the alert such as active or cleared.
Assigned ToName of the assignee for the alert
Rule NameName of the rule that was applied to the alert generation
Incident IdIncident ID
Incident PriorityIncident priority
Incident UrlLink to the incident
Pipeline TimestampInternal data
Alert CreatedInternal data
Updated TimestampInternal data
Actioned ByInternal data
Rule KeyInternal data
Rule ValueInternal data
Organisation IDInternal data
Receiver IdInternal data
Receiver TimestampInternal data
Original KeyInternal data
Updated TimestampInternal data
VersionInternal data
Source RecordInternal data
Agent IDInternal data
Agent CIInternal data
Agent IPInternal data
Agent TimestampInternal data
CreatedTimestampInternal data