Triage, acknowledge, and resolve alerts
Find the alerts that need attention, inspect the rule and supporting measurements, and record a deliberate triage decision.
Before you start
- Select the organization whose alerts you are investigating.
- An enabled rule and its required data source are needed before the engine can produce a corresponding alert.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Open Alerts and choose the investigation window
Open Alerts. Start with Active status and the relevant time range, then use Search hostname… for a reported device. Read the summary and loading notices before interpreting a zero count.
| Field or control | What to do |
|---|---|
| Severity | All severity, Critical, Warning, or Info. |
| Status | All status, Active, Acknowledged, or Resolved. |
| Persona / Rule | Restrict results to a functional area or one rule. |
| Time range | Controls the window represented in the feed; a narrow window can exclude older active records. |
Inspect the alert details
Use the row’s detail action to open the alert. Read its rule, severity, device or scope, trigger time, and recorded value. The detail view includes the rule condition and, when available, a metric trend over the last 30 minutes. A missing trend means there are no usable observations for that chart; it does not mean the value was zero.
What you should see: You have the condition that opened the alert and the evidence available to investigate it.
Open the affected device or finding
Follow the device link for its workspace and diagnostic tabs. If the row shows an investigation link, open the associated finding. For an alert that applies to a fleet or cohort, investigate its scope instead of expecting it to identify one device.
Acknowledge the alerts you have taken ownership of
Click Ack on an active alert. To acknowledge several, check the corresponding rows and click Ack followed by the selected count. Acknowledgement records a triage state; it does not run a remediation or establish that the issue has recovered.
What you should see: The record moves to Acknowledged. Include that status in your filter if you want to keep seeing it.
Resolve or reopen deliberately
After checking the cause and outcome, use Resolve to mark a non-resolved alert resolved. Use Reopen on an acknowledged or resolved alert when it needs active attention again. Revisit the device observation or follow-up scan to confirm the operational state independently of the alert’s status.
What you should see: The alert status reflects your decision, and the supporting device evidence explains why you made it.
Tune recurring noise at its source
Choose Detections to inspect threshold, duration, cooldown, and ticketing settings. Use the detection catalogue to enable a shipped definition or inspect whether its collector or connector is ready. Changing an alert status does not alter the rule that generated it.
What you should see: You can adjust the detection or its prerequisites without confusing that configuration change with a resolved incident.
If something doesn’t work
The feed is empty but I expected an alert.
Clear hostname, persona, and rule filters, widen the time range, and include all statuses. Then check that the rule is enabled and its metric is being collected.
The alert changes status but remains visible.
The current filter may include the new status. Read the row’s badge, and switch Status to Active if you want only unacknowledged work.
Names, rule details, or counts cannot be loaded.
Use the displayed Retry alerts or Retry alert details action. Treat the source warning as unavailable evidence, not an all-clear.