Alert lifecycle

Overview

Alerts in ToBeAlert follow a defined lifecycle that represents their progression from creation to resolution. Understanding this lifecycle is crucial for effective alert management and workflow optimization.

Alert states

Alerts can exist in several states throughout their lifecycle:

State	Description
open	The default state for new alerts that require attention
assigned	Alert has been assigned to a specific user or team
ack (acknowledged)	Alert has been acknowledged, indicating someone is working on it
unack (unacknowledged)	Alert was previously acknowledged but has been reset to unacknowledged
shelved	Alert has been temporarily set aside or suppressed
unshelved	Alert was previously shelved but has been reactivated
closed	Alert has been resolved and no further action is needed
expired	Alert has expired due to timeout or other automatic conditions
deleted	Alert has been permanently removed from active view

State transitions

The diagram below illustrates the possible transitions between alert states:

                  ┌─────────┐
                  │         │
                  ▼         │
┌─────┐       ┌────────┐    │      ┌─────────┐
│OPEN ├──────►│  ACK   │◄───┼──────┤ SHELVED │
└─────┘       └────┬───┘    │      └────┬────┘
   ▲               │        │           │
   │               ▼        │           ▼
   │           ┌────────┐   │      ┌─────────┐
   └───────────┤ UNACK  ├───┼─────►│UNSHELVED│
               └────────┘   │      └─────────┘
                            │           │
                            │           │
                            │           ▼
                      ┌─────┴────┐ ┌─────────┐
                      │  CLOSED  │ │ EXPIRED │
                      └──────────┘ └─────────┘

State restrictions and rules

Certain restrictions apply to state transitions:

• When an alert is in the closed state, only watch, re_open, or delete actions are permitted
• When an alert is shelved, attempting to acknowledge it will result in an error
• If an alert is already shelved and a shelve action is requested, it will automatically be unshelved instead
• If an alert is already ack (acknowledged) and an ack action is requested, it will automatically be unack (unacknowledged) instead

Alert actions

The following actions can be performed on alerts to change their state:

Action	Description
watch	Mark an alert as being watched (doesn't change state)
assign	Assign the alert to a user or team
ack	Acknowledge the alert
unack	Unacknowledge a previously acknowledged alert
shelve	Shelve (suppress) the alert temporarily
unshelve	Unshelve a previously shelved alert
close	Close the alert (resolve)
re_open	Reopen a previously closed alert
delete	Delete the alert

Additional functionality

In addition to state changes, alerts support:

• Notes: Add contextual information to alerts at any point in their lifecycle
• History: Track all changes and actions performed on an alert
• Instructions: Link to specific instructions for handling particular alert types

Best practices

For effective alert lifecycle management:

1. Acknowledge alerts promptly when you start working on them
2. Add notes to provide context about actions taken or observations
3. Shelve alerts that need to be temporarily suppressed but not closed
4. Close alerts only when they are truly resolved
5. Use the history view to understand the progression of an alert

Understanding and properly utilizing the alert lifecycle helps ensure that all alerts are properly tracked and resolved, improving overall system reliability and team efficiency.