Alerts
Understand the alert lifecycle in NearIRM. Learn about alert states, acknowledgment, resolution, and available actions
What are Alerts?
Alerts are the core objects in NearIRM. When your monitoring tool detects an issue and sends a webhook, NearIRM creates an alert and routes it through your policies.
Alert Lifecycle
Alerts flow through these states:
Firing -> Acknowledged -> ResolvedFiring
Initial state when alert arrives. Means:
- Issue is active
- Notifications being sent
- Escalation timer running
Acknowledged
Someone has seen and is working on the alert:
- Escalation stops
- No further notifications for this alert
- Issue still exists but being handled
Resolved
Issue is fixed. Can happen via:
- Manual resolution in NearIRM
- Resolved webhook from monitoring tool
- Auto-resolve after timeout
Alert Properties
| Property | Description |
|---|---|
| Title | Alert name from source |
| Description | Detailed information |
| Severity | Critical, High, Medium, Low, Info |
| Source | Integration that received it |
| Labels | Key-value metadata |
| Status | Current lifecycle state |
| Created | When alert first fired |
Alert Actions
Acknowledge
Stops escalation and marks you as handling the issue:
- Go to alert detail page
- Click Acknowledge
- Status changes to "acknowledged"
Via notification: Click the acknowledge link in email/push notifications.
What happens:
- Escalation timer cancels
- No more notifications for this alert
- Alert stays visible until resolved
Resolve
Marks the issue as fixed:
- Go to alert detail page
- Click Resolve
- Add optional resolution note
- Status changes to "resolved"
Auto-resolve: Alerts auto-resolve after a configurable timeout if no new firing events received.
External resolve: When your monitoring tool sends a "resolved" webhook, NearIRM automatically resolves the alert.
Alert Timeline
Each alert has a timeline showing:
- When alert was created
- Notifications sent (with delivery status)
- Acknowledgments (who, when)
- Escalations triggered
- Resolution (manual, auto, or external)
Filtering Alerts
The alerts list supports filtering by:
| Filter | Options |
|---|---|
| Status | Firing, Acknowledged, Resolved |
| Severity | Critical, High, Medium, Low, Info |
| Search | Title, labels, description |
Tip: Bookmark filtered views for quick access (e.g., "Firing Critical Alerts").
Alert Deduplication
NearIRM deduplicates alerts by fingerprint:
- Same source + same labels = same alert
- Repeated firing events update existing alert
- Prevents notification spam for flapping alerts
Best Practices
- Acknowledge promptly - Stops unnecessary escalation
- Add resolution notes - Helps future debugging
- Review resolved alerts - Look for patterns
- Configure auto-resolve - Prevents stale alerts