Alerts & Events

An event is a single raw monitoring signal — a metric reading, a threshold breach, an interface state change. Events are correlated (by node, or by configuration item + metric) and roll up into an alert, the actionable record an operator actually triages.

Severity

Both events and alerts carry the same five-point severity scale, most severe first:

Value	Label
1	Critical
2	Major
3	Minor
4	Warning
5	OK / Info

Alert priority (Critical/High/Moderate/Low) is a separate, independently-set triage rank — it doesn’t have to match severity.

Alert lifecycle

State	What it means	Typical next action
Open	New or unacknowledged.	Acknowledge, Maintenance, Close, or Create Incident
Reopened	Re-triggered after being closed.	Acknowledge, Maintenance, Close, or Create Incident
Acknowledged	Someone has taken ownership.	Unacknowledge, Maintenance, Close, or Create Incident
Flapping	Muted into a maintenance window because the signal is noisy/unstable.	Close
Snoozed	Temporarily muted.	Close
Closed	Terminal — resolved or auto-closed.	Reopen

Acknowledge takes ownership without changing anything else; Unacknowledge reverses it. Maintenance mutes a flapping alert without closing it. Create Incident is available on Open, Reopened, and Acknowledged alerts — it opens a remediation incident and links it back onto the alert’s Task field, without moving the alert’s own state.

An alert also tracks its event count, initial event time, and last event time — the span between first and last occurrence — so you can see at a glance whether a signal is a one-off or sustained.

Event lifecycle

State	Typical next action
Ready	Process, or Ignore
Processed	— (rolled into its correlated alert)
Ignored	— (suppressed, e.g. by an ignore rule for a decommissioned source)
Error	—

Process binds the event to a configuration item and correlates it into an alert (or a new one); Ignore suppresses it without further action.

Correlation

An alert’s Events related list shows every raw event that correlated into it — matched by the same node, or by the same configuration item and metric. Its Related Alerts group surfaces sibling alerts on the same configuration item or business service, sorted most-severe-first, so you can see the blast radius of a single underlying problem at a glance rather than working each alert in isolation. A correlation-group summary rolls up the total member count, the worst severity in the group, and how many members are still open.

The alert’s context panel also surfaces the health of its impacted configuration item — open alerts, open incidents, and recent changes against it — plus a short list of suggested runbook steps (diagnose, remediate, or escalate) matched to the alert’s type, so triage starts with a concrete next action instead of a blank investigation.