How to work the alerts desk one row at a time
Acknowledge alerts. Read Count and First seen. See why there is no mute or resolve here.
Browse
On this page
How to do it
Open Alerts and look at the rows.
The desk opens on Open alerts. Each row shows Severity, Client, Alert and Count. It also shows First seen and Last seen.
Read Count, First seen and Last seen.
Count is how many times the alert has been true since it last cleared. First seen is when it first became true this time. Last seen is the latest time it was true. Hover over a time to see the exact date in your time zone. CyberSentry and Expiration rows show a dash. They keep no count here. A device's Alerts tab shows the same three columns.
Spot a quiet alert.
The quietest Severity is called Informational. It sits below Low. It is news that nobody has to act on, so it never opens a ticket. It still shows here, and the Severity filter finds it. Want an email and a bell entry when a rule sends one? Open My Settings, then Notifications. Turn on the Security: low-confidence notice switch.
Acknowledge what you have seen.
Tick the box on each row you want. The box in the header takes every open alert on the page. Press Acknowledge in the bar above the table. A single row also has its own Acknowledge next to Open. Acknowledged rows leave the default view. The record carries your name. It reads the same in the audit log as one made on the alert's own page.
Press Open to resolve, mute or put away.
Resolve asks for a written reason, so it lives on the alert's own page. Use Open at the end of the row. Mute is a noise control for one device. It only stops the telling. The alert stays open and still counts. Dismiss, Silence for 7 days, Silence for 30 days and Ignore on this device work on one device. They put the problem away. Choose these on the device, from its Alerts tab or its Health issues card. Nobody is told and no ticket opens. Dismiss holds until the problem gets worse or happens again. Silence holds for 7 or 30 days. Ignore holds until someone restores it. The audit log records who chose and when. The how-to Dismiss, silence or ignore a device health issue in RMM has the full steps.
What you will have
- Acknowledge one alert or many from the desk.
- Read Count, First seen and Last seen.
- Know what the quietest Severity means.
- Know where to resolve, mute, silence or ignore an alert.
Why it works this way: How to work the alerts desk one row at a time
Acknowledge means I have seen this and I am on it. It is not a resolution. The alert stays live.
The desk does one thing, so each row is one decision. There is no snooze anywhere. Acknowledging is how a row leaves the working view.
If it did not work: How to work the alerts desk one row at a time
- Acknowledge is refused on a row: someone else may have acted on it. Or you may lack edit rights for that kind of alert.
- You see no mute or resolve on the desk: that is by design. Use Open at the end of the row.
- An Administrator added alert did not come back as a new row: a person closed it. The same administrator was added again within 7 days. So the old alert's Count went up, and no new alert opened.
Questions this page answers
How do I acknowledge alerts?
Tick the rows on the alerts desk and press Acknowledge in the bar above the table. It says you have seen it and are on it. The alert stays live.
Why is there no mute or resolve on the alerts desk?
The desk only acknowledges. Resolve and mute live on the page that owns the alert. Use Open at the end of the row.
What do Count, First seen and Last seen mean on an alert?
Count is how many times the alert has been true since it last cleared. First seen is when it began. Last seen is the latest time it was true.
Was this helpful?