Alert Records
Last updated on 02 September, 2024An alert is created when the Create Alert action runs in response to an automatic rule firing. The Create Alert action creates a new alert record and copies the event fields from the triggering record to the alert.
Alert Record Format
The alert field definitions are described in the following:
| Column | Description |
| _id | The ID of the database record. |
| CI | The configuration item for which the event is being reported for example a server or router hostname. |
| Description | A short summary of the alert. |
| Details | A verbose summary of the event. |
| Name | The name of the event reported, for example, Low Disk Space or High CPU Utilization. |
| Source | The monitoring/management tool, application, log or API from which the event was generated. |
| Tenant ID | LM Tenant Identifier |
| #Events | Number of deduplicated events |
| Escalation | The state represents the lifecycle of an alert record from new to closed. |
| Timestamp | Timestamp of the event that created the alert. |
| First Timestamp | Earliest event within the deduplicated events. |
| Insight Key List | A list of correlated insights the alert belongs to. |
| Last Event Timestamp | Latest event within the deduplicated events. |
| Permanent URL | URL to the alert ID |
| Severity | The severity of the recent event. |
| Highest Severity | The highest severity event contained within the alert’s deduplicated event set. |
| Lowest Severity | The lowest severity event contained within the alert’s deduplicated event set. |
| State | The state of the alert such as active or cleared. |
| Assigned To | Name of the assignee for the alert |
| Rule Name | Name of the rule that was applied to the alert generation |
| Incident Id | Incident ID |
| Incident Priority | Incident priority |
| Incident Url | Link to the incident |
| Pipeline Timestamp | Internal data |
| Alert Created | Internal data |
| Updated Timestamp | Internal data |
| Actioned By | Internal data |
| Rule Key | Internal data |
| Rule Value | Internal data |
| Organisation ID | Internal data |
| Receiver Id | Internal data |
| Receiver Timestamp | Internal data |
| Original Key | Internal data |
| Updated Timestamp | Internal data |
| Version | Internal data |
| Source Record | Internal data |
| Agent ID | Internal data |
| Agent CI | Internal data |
| Agent IP | Internal data |
| Agent Timestamp | Internal data |
| CreatedTimestamp | Internal data |