Alerts
Understand alert lifecycle, states, and available actions
What are Alerts?
Alerts are the core objects in NearIRM. When your monitoring tool detects an issue and sends a webhook, NearIRM creates an alert and routes it through your policies.
Alert Lifecycle
Alerts flow through these states:
Firing -> Acknowledged -> ResolvedFiring
Initial state when alert arrives. Means:
- Issue is active
- Notifications being sent
- Escalation timer running
Acknowledged
Someone has seen and is working on the alert:
- Escalation stops
- No further notifications for this alert
- Issue still exists but being handled
Resolved
Issue is fixed. Can happen via:
- Manual resolution in NearIRM
- Resolved webhook from monitoring tool
- Auto-resolve after timeout
Alert Properties
| Property | Description |
|---|---|
| Title | Alert name from source |
| Description | Detailed information |
| Severity | Critical, High, Medium, Low, Info |
| Source | Integration that received it |
| Labels | Key-value metadata |
| Status | Current lifecycle state |
| Created | When alert first fired |
Alert Actions
Acknowledge
Stops escalation and marks you as handling the issue:
- Go to alert detail page
- Click Acknowledge
- Status changes to "acknowledged"
Via notification: Click the acknowledge link in email/push notifications.
What happens:
- Escalation timer cancels
- No more notifications for this alert
- Alert stays visible until resolved
Resolve
Marks the issue as fixed:
- Go to alert detail page
- Click Resolve
- Add optional resolution note
- Status changes to "resolved"
Auto-resolve: Alerts auto-resolve after a configurable timeout if no new firing events received.
External resolve: When your monitoring tool sends a "resolved" webhook, NearIRM automatically resolves the alert.
Alert Timeline
Each alert has a timeline showing:
- When alert was created
- Notifications sent (with delivery status)
- Acknowledgments (who, when)
- Escalations triggered
- Resolution (manual, auto, or external)
Filtering Alerts
The alerts list supports filtering by:
| Filter | Options |
|---|---|
| Status | Firing, Acknowledged, Resolved |
| Severity | Critical, High, Medium, Low, Info |
| Search | Title, labels, description |
Tip: Bookmark filtered views for quick access (e.g., "Firing Critical Alerts").
Alert Deduplication
NearIRM deduplicates alerts by fingerprint:
- Same source + same labels = same alert
- Repeated firing events update existing alert
- Prevents notification spam for flapping alerts
Best Practices
- Acknowledge promptly - Stops unnecessary escalation
- Add resolution notes - Helps future debugging
- Review resolved alerts - Look for patterns
- Configure auto-resolve - Prevents stale alerts