Understand alerts and alert details

Users with the following roles can perform these actions in this feature area:
Operator: View, assign, resolve, and close alerts.	Administrator: View, assign, resolve, and close alerts.	Owner: View, assign, resolve, and close alerts.

Supported operations

You can do the following in this view:

Update the assignee and status (In Progress, Resolve, Close)
To update multiple alerts, select the alerts and then right-click.
Copy visible attributes for one or alerts (with or without headers) and paste into a text file
To copy attributes for multiple alerts, select the alerts and then right-click.
Copy a link to an alert. Select the alert and then right-click.

Alert attributes

The following table describes the alert attributes available in the alerts and the alert details tables.

Note

Unless otherwise noted, the term "events" refers to both ingested event notifications and metric anomalies.

Moogsoft stores all timestamps in UTC format. The dates and times displayed in the UI are based on your browser's local time.

Column	Description
Active Incidents Count	The number of active incidents in which the alert is included. If you have multiple correlation definitions, one alert might fit multiple definitions and thus get included in multiple incidents.
Alias	The alias for the alert source, as defined in the `alias` field in the event or the `source` field in the anomaly. You can specify aliases through ingestion or enrichment.
Assignee	The Moogsoft user currently assigned to investigate this alert.
Class	The high-level category of the performance issue reported by the alert. Examples include `application`, `network`, `middleware`, and `cloud`. This value is based on the `service` field in events. If a metric anomaly does not have a `service` tag specified, Moogsoft auto-generates this field based on the metric source and name.
Creation Time	The timestamp when Moogsoft ingested the first event, identified it as unique, and created the new alert.
Description	Alert description, based on the `description` field in the ingested event.
Event Count	Number of events in the alert.
External ID / Name	If the alert triggered an external notification based on an outbound webhook, this indicates the object (such as a ticket number) in the external system.
First Event Time	The timestamp of the first event or anomaly added to the alert.
ID	The alert ID. Moogsoft auto-generates the ID when it creates the alert.
Incident Count	The number of incidents in which this alert is included. This number includes both open and resolved incidents. If you have multiple correlation definitions, one alert might match multiple definitions and be included in multiple incidents.
Integration Name / ID	The outbound integration name and ID, if the alert triggered an external notification based on an outbound webhook.
Last Event Time	Timestamp of the most recent event included in the alert.
Location	You can include generic geolocation information in the `location` field of an ingested event. This is a structured list of key-value pairs, such as `{ City: 'London', Street: '31 High Street'}`
Manager	The generator or intermediary of the events in this alert.
Manager ID	A machine-level reference to the manager.
Service	The external application or service that generated the ingested event or metric. This is a required field for ingested events and is used to identify duplicate and similar events.
Severity	Current severity of the alert, determined by the most recent event in the alert.
Source	The node where the original events and/or anomalies occurred. This is typically an IP or fully-qualified domain name.
Status	The alert status as specified by the Status pull-down menu in the Alert Details tab: Unassigned, Assigned, Acknowledged, etc.
Tags	All optional tags included in this alert. You can specify tags during ingestion, or use event enrichment to add tags after ingestion.

In this section:

Provide feedback for this page.