Get early access
Features · Alerting & Incidents · Smart Alerts
Alerting & Incidents · Smart Alerts

Multi-source rules,
with the brakes built in.

Compose alert rules that span metrics, logs, heartbeats and uptime. Anti-flapping, severity, durations, include / exclude targets. The boring controls that turn a noisy alert into a useful one.

rule · checkout latency
when uptime p95 > 2s for 5 minutes, 2 regions except maintenance windows severity page routes to Slack #ops · PagerDuty
— Why this matters

Most alerting is one threshold and a lot of regret.

01

A rule that names hosts is a rule that rots.

Target by tag, then exclude the two boxes that are allowed to be different. Exclude wins on overlap, so the exception is one line rather than a rewritten rule.

02

Duration is what separates a spike from a problem.

CPU touching 90% for four seconds is normal. Ninety percent for five minutes is not. Every condition carries a duration.

03

An alert should be able to fix things.

Firing can open a ticket, restart a service, run a recipe or call a webhook — so the page is the fallback, not the first step.

— What's included

What you can build a rule from.

Seven sources
Server metrics, uptime, backups, heartbeats, certificates, anomalies and budget — one rule format across all of them.
Metric conditions
CPU, memory, disk, load, network, container and queue, compared with gt, gte, lt, lte or eq.
Durations
Every condition holds for a period before it counts.
Include and exclude
A side-by-side picker per rule. Target the tag, subtract the exceptions.
Two severities
Warning and critical, routed differently because they mean different things.
Auto-actions
Create a ticket in GitHub, Jira or Linear; restart the service; run a recipe; call a webhook.
Acknowledgement
With the user attached, so "someone is on it" is a fact rather than an assumption.
Delivery log
Per event, so you can tell a rule that did not fire from a notification that did not arrive.
Context on the event
A deviation bar and a ±30-minute sparkline with the moment marked, so the number has a shape.
— How it works

Selectors, duration, then action.

1

Match, do not name

Rules select by tag, group and provider. A rule that names hosts starts rotting the day you add the next one.

2

Hold for a duration

A threshold has to stay crossed for the time you set. Duration is what separates a spike from a problem.

3

Act, then notify

An alert can run a recipe before it pages anyone, so the obvious fix has already been attempted by the time you read it.

— Works with

Connected capabilities

Notification Channels
Where alerts go: Slack, email, push, webhook.
→
Auto-Recovery
Some alerts trigger a restart before they trigger a page.
→
Maintenance Windows
Suppress alerts during planned maintenance.
→
AI Triage
When multiple alerts fire, AI Triage groups them into one incident.
→
— FAQ

Questions, answered honestly.

Is there a rules-as-code option? +
Yes — YAML import / export per rule, Terraform provider, REST API.
Can a rule call a recipe? +
Yes — Auto-Recovery is a special case of this; Recipes can be invoked directly from a rule.
What about rate-limiting? +
Per-rule rate limit + global per-channel rate limit. Burst-friendly, sustained-rate aware.

Alerts that page for the right reason, not the loud one.

Smart Alerts on every plan; composite rules from Starter.

Get early access Back to Alerting & Incidents