Alert structure and data model

Overview

In ToBeAlert, alerts follow a structured data model that enables efficient management, filtering, and visualization. Understanding this structure is essential for effectively working with the system.

Alert object structure

Each alert in ToBeAlert is represented as an object with the following key properties:

Property	Type	Description
id	String	Unique identifier for the alert
environment	String	The environment where the alert originated
severity	Number	Numerical value representing the alert's severity level
status	String	Current status of the alert in its lifecycle
text	String	Main descriptive text of the alert
event	String	The type of event that triggered the alert
attributes	Object	Custom key-value pairs providing additional context
createTime	Date	When the alert was created
lastReceiveTime	Date	When the alert was last updated
resource	String	The resource affected by the alert
service	Array	List of services related to the alert
group	String	Organizational group the alert belongs to

Severity levels

ToBeAlert uses a numerical scale for severity levels, with corresponding text representations:

Severity number	Severity text	Description
0	security	Security-related alerts requiring immediate attention
1	critical	Critical issues that need urgent resolution
2	major	Major problems affecting system functionality
3	minor	Minor issues with limited impact
4	warning	Warnings about potential problems
5	indeterminate	Issues with undetermined severity
6	informational	Informational alerts, no action required
7	normal	Normal operation (includes "ok" and "cleared" states)
8	debug	Debug-level information
9	trace	Detailed trace information
10	unknown	Unknown severity level

The severity level is visually represented in the UI with color coding to help quickly identify critical issues.

Alert identification

Each alert has a unique identifier (id) that is used throughout the system to reference the specific alert. This ID is used when:

• Performing actions on alerts
• Adding notes to alerts
• Retrieving alert history
• Creating links to specific alerts

Example alert object

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "environment": "production",
  "severity": 2,
  "status": "open",
  "text": "High CPU usage detected on web server",
  "event": "HighCpuUsage",
  "attributes": {
    "cpu_percent": "95.2",
    "server_name": "web-01",
    "region": "us-west"
  },
  "createTime": "2025-03-15T08:30:00.000Z",
  "lastReceiveTime": "2025-03-15T08:35:00.000Z",
  "resource": "web-01.example.com",
  "service": ["web-service", "customer-portal"],
  "group": "infrastructure"
}

Working with alert data

The ToBeAlert interface provides several ways to interact with alert data:

• Alert table: Displays alerts in a tabular format with sortable columns
• Filters: Create custom filters based on any alert property
• Details view: Access comprehensive information about a specific alert
• Bulk operations: Perform actions on multiple alerts simultaneously

Understanding the alert structure allows you to create effective filters, sort alerts meaningfully, and quickly identify the most important issues that need attention.