> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/overview.md).

# Route Alerts

Alert rules define how incoming alerts are processed and when incidents should be created.

### Overview <a href="#overview" id="overview"></a>

Alert rules help you:

* Create incidents from incoming alerts
* Map alert data to incident fields
* Set up automated responses with conditional logic
* Configure Harness AI SRE on-call notifications and paging
* Associate relevant runbooks for automated response

***

### Alert rule capabilities <a href="#alert-rule-capabilities" id="alert-rule-capabilities"></a>

#### Field-based conditions <a href="#field-based-conditions" id="field-based-conditions"></a>

The default mode for alert rules uses a visual builder where you can:

* Select alert fields from your monitoring integrations
* Choose comparison operators (equals, contains, greater than, and others)
* Combine multiple conditions with AND/OR logic
* No coding required

#### CEL expression conditions <a href="#cel-expression-conditions" id="cel-expression-conditions"></a>

Write advanced boolean expressions for complex filtering:

* Regex pattern matching for service names
* Complex multi-field logic
* String operations and numeric comparisons
* More concise than multiple field-based conditions

Go to [Use CEL to Route Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/use-cel-alert-rules.md) to understand CEL expression mode.

#### Incident creation <a href="#incident-creation" id="incident-creation"></a>

Automatically create incidents from matching alerts:

* Map alert fields to incident properties
* Set incident severity and priority
* Associate services and environments
* Populate custom fields

#### On-call notifications <a href="#on-call-notifications" id="on-call-notifications"></a>

Page the on-call team when critical alerts arrive:

* Select impacted services
* Configure escalation policies
* Choose notification channels
* Set response time expectations

#### Runbook association <a href="#runbook-association" id="runbook-association"></a>

Attach automated response procedures:

* Automatically trigger runbooks on incident creation
* Suggest runbooks to responders
* Provide reference documentation

***

### Getting started <a href="#getting-started" id="getting-started"></a>

Go to [Create an Alert Rule](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/create-alert-rule.md) for step-by-step configuration instructions.

***

### Best practices <a href="#best-practices" id="best-practices"></a>

Keep these guidelines in mind when you create and maintain alert rules:

* Create specific rules for different types of alerts
* Use clear, descriptive names for your rules
* Test rules with sample alerts before activating
* Review and update rules as your services evolve
* Document your rule configurations for team reference

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Create an Alert Rule](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/create-alert-rule.md): Configure your first alert rule.
* [Use CEL to Route Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/alert-rules/use-cel-alert-rules.md): Apply advanced conditional logic.
* [Ingest Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/webhooks/overview.md): Receive alerts from any monitoring system.
* [Create Runbooks](/ai-sre/ai-sre-for-administrators/set-up-runbook-management/create-runbook.md): Automate alert responses.