Create an Alert Rule
Route, filter, and enrich incoming alerts with rules.
This guide walks you through creating alert rules that define how incoming alerts are processed and when incidents should be created.
Configuration steps
Step 1: Access alert rules
Open the alert rules list to start a new rule:
From the main menu, select Alerts.
Click Alert Rules.
Click New Alert Rule.
Step 2: Configure integration and conditions
Select the source integration and define when the rule triggers:
Under Integration & Conditions, select the source integration from your connected monitoring tools.
Select your condition mode:
Field-based conditions (default): Visual builder with field comparisons.
CEL expressions: Advanced boolean expressions for complex logic.
For field-based conditions:
Click New Condition to define when alerts should trigger incidents.
Select the conditions on which you want alerts to be triggered:
Alert severity or priority
Service or application name
Environment
Alert message content
Custom alert fields
For each condition:
Select the field from your alert payload.
Select the operator (equals, contains, greater than, and others).
Enter the value to match against.
Click Add Condition to configure multiple conditions for the alert rule.
Use AND/OR operators to combine multiple conditions as needed.
For CEL expressions:
Toggle to CEL mode in the conditions section.
Go to Use CEL to Route Alerts for detailed examples and configuration instructions.
Step 3: Configure incident creation (optional)
Map matching alerts to incidents and their fields:
Click Create Incident to automatically create incidents from matching alerts.
Select the Incident Type that should be created.
Map alert fields to incident fields using the field mapper:
Title: Map the alert summary or message.
Description: Map detailed alert information.
Severity: Map alert severity levels.
Priority: Set incident priority based on alert data. Go to Configure priority labels to configure priority levels.
Service: Map affected service information.
Environment: Map environment details.
Custom fields: Map any additional alert data.
Step 4: Configure on-call notifications
Page the on-call team when alerts match your conditions:
Click Page Team to automatically page the on-call team when alerts match your conditions.
Select the checkbox to activate on-call paging.
Select the Impacted Services from your service directory.
Select the specific service that will be impacted from the dropdown list.
Configure notification settings:
Which teams should be notified
Escalation policies to use
Response time expectations
Notification channels (email, SMS, phone, Slack, mobile app)
Step 5: Associate runbooks (optional)
Attach automated response procedures to the rule:
Select the Runbooks tab to attach automated response procedures.
Click Attach Runbook to connect relevant runbooks to your alert rule.
Select the runbook that should be triggered when an alert or incident occurs.
Click Attach Runbook to confirm the selection.
These runbooks can be:
Automatically triggered when an incident is created
Suggested to responders during incident resolution
Used as reference documentation for AI SRE
Step 6: Save and activate
Save the rule so it begins processing incoming alerts:
Review all your configurations.
Click Save from the top right corner.
The alert rule is created and available in your alert rules list.
The rule begins processing incoming alerts based on your configured conditions.
Follow this interactive guide to configure alert rules that automatically create incidents and page on-call teams.
Best practices
Keep these guidelines in mind when you create and maintain alert rules:
Create specific rules for different types of alerts
Use clear, descriptive names for your rules
Test rules with sample alerts before activating
Review and update rules as your services evolve
Document your rule configurations for team reference
Next steps
Use CEL to Route Alerts: Apply advanced conditional logic.
Ingest Alerts: Receive alerts from any monitoring system.
Create Runbooks: Automate alert responses.
Last updated
Was this helpful?