Alerts

Text size

Alerts

Open Aiden SRE -> Alerts to review ingested alerts in the selected workspace. Start with the priority and incident summary, then inspect related signals before deciding whether to investigate, recategorize, or ignore an alert.

For delivery setup, see Alert ingestion. For rules that control which alerts arrive, see Filters.

Choose a queue and priority

Active contains the working queue. Ignored contains alerts responders have moved out of that queue.

Select a summary card to narrow the list:

Card	Meaning
All Active	Every alert in the active queue
Act now	User impact or imminent risk
Non Critical	Valid alert with no current impact
False Positive	Likely not a real incident
Needs review	Human review is needed to classify the alert

Classification may still be running after alerts arrive. The organizing banner, pending counts, or Grouping with related alerts text mean triage is incomplete; a dash does not mean there are zero alerts in that category.

If a row says Classification failed, open the details and inspect the payload. You can categorize it manually or investigate it; the failed classification does not establish that the alert is a false positive.

Use search, source, severity, correlation, sorting, and pagination to find a row. If none match, clear the relevant controls and check Ignored. See queue filters.

Read an alert

Select the alert title to open its details drawer.

Detail	How to use it
Triage priority	Aiden's assessment of the attention the alert needs
Monitor severity	Severity reported by the alert source; this can differ from the triage priority
Blast-radius impact	Assessment of the affected scope, when available
Alert role	Whether the signal is a root signal or a downstream effect in a linked group
Source and delivery badge	The integration instance and whether the alert arrived by pull or webhook
Incident summary	A concise explanation; use Copy incident summary when handing off
Why this attention level	Expand to inspect the classification rationale
Alert payload	Expand to inspect the data received from the source
Investigation	Expand for linked investigation context

The table's summary icon also exposes Aiden's summary where available. Provider descriptions can contain unexpanded template text; use the payload and telemetry to check the actual affected resource.

Follow related signals

Root signal marks a suggested starting point in a linked group. Downstream effect marks an alert that may be a consequence of another signal. Follow Check first links to inspect the suggested root alert.

For example, a database-down alert and an exporter-error alert can appear together. Check the database signal and evidence before treating the exporter error as a separate incident. Correlation is a lead to investigate, not proof of causality.

Review or correct a category

1. Select Categorize alert or Recategorize alert from a row, or Recategorize in the drawer.
2. Review the current summary and reason.
3. Choose Act now, Non Critical, or False Positive and apply the change.
4. Check the appropriate summary card for the updated alert.

Changing a category records the triage decision. It does not change the severity configured in the source monitor.

Ignore an alert

Choose Ignore, optionally enter a reason, and confirm. The alert moves to Ignored, where the team can review it later. Select multiple table checkboxes to use the available bulk actions.

Ignoring is an SRE queue decision. If your goal is to prevent future ingestion, configure an ingestion filter; if your goal is to silence the monitor, manage that in the source system.

Start or continue an investigation

Select Investigate from the row or drawer. SRE opens a conversation with the alert's name, description, severity, source, time, and identifiers. Review the result and follow up in context. Linked cases are also available from Investigations. See Investigation workspace for a guided walkthrough.

Automatic investigation is configured per delivery method in Alert ingestion.