Concepts
Understand the objects and states that define routing and response.
Services
A service represents one monitored system. Each service routes new alerts to one schedule. Direct sources bind to one service, while vendor rules can route events into it.
Sources
A source receives signals from one sender format. An Acked webhook, PagerDuty source, or email source sends every signal to its bound service.
A Datadog, Grafana, Alertmanager, or Custom vendor connection belongs to the organization. Ordered exact-match rules route payload attributes to services. A required fallback handles every unmatched event.
The customer API uses the historical object name integration. The product and documentation call it a source.
Schedules
A schedule defines who is on call. Rotation layers select people over time. Escalation levels select who is paged next while an alert remains unacknowledged.
An override replaces the scheduled person for a defined time window.
Alerts
An alert is the response record for a monitored condition. It contains the current state, priority, urgency, responders, delivery attempts, and timeline.
| State | Meaning |
|---|---|
notifying | Acked is paging a responder. |
acked | A responder accepted responsibility. |
snoozed | Paging is paused until the wake time. |
unreachable | The escalation passes ended without acknowledgement. |
resolved | The alert is closed. |
notification | An information alert was delivered once. |
Priority and urgency
Priority classifies impact and controls sort order. Urgency controls notification behavior.
| Axis | Values | Effect |
|---|---|---|
| Priority | critical, high, medium, low, info | Human impact and list order. |
| Urgency | high, low | Critical or ordinary notification delivery. |
Deduplication
One service and event key identify one open condition. Repeat signals join that alert and increase its duplicate count.
A recovery signal closes the open alert. A later trigger with the same key creates a new alert.
Destinations
A destination receives lifecycle events from Acked. Slack channels and HTTPS webhooks are destinations. They are optional and do not control paging.
Timeline and audit ledger
Every alert state change creates an append-only audit event in the same database transaction. Alert pages show incident-specific events. The Audit page shows organization activity.
The newest event appears first. Audit details contain identifiers and do not contain personal contact information.