Alert history tracking

Overview

ToBeAlert provides comprehensive alert history tracking that records all changes and actions throughout an alert's lifecycle. This feature enables accountability, supports troubleshooting, and helps with compliance requirements.

Alert history data

What is tracked

The history system captures detailed information about each alert:

• Status changes - Transitions between alert states (open, acknowledged, closed, etc.)
• Note additions - When users add comments or notes to alerts
• Note deletions - When notes are removed from alerts
• Tool executions - When custom tools are run against alerts
• Attribute changes - When alert attributes are modified
• Tag changes - When tags are added or removed
• Assignment changes - When alerts are assigned to different users

History record structure

Each history record contains:

Field	Description	Example
Alert ID	The unique identifier of the alert	a1b2c3d4-e5f6
Timestamp	When the action occurred	2025-04-01T10:30:15Z
User	Who performed the action	john.smith
Action	What type of change was made	status_change
Previous Value	The state before the change	open
New Value	The state after the change	acknowledged
Notes	Additional context about the change	Acknowledged during incident #1234

Viewing alert history

Individual alert history

To view the history for a specific alert:

1. Select the alert in the alert table by right-clicking
2. Click the "History" option in the context menu
3. The history view displays all changes in chronological order
4. Use filters to focus on specific types of changes

System-wide history view

For a broader view of alert history:

1. Navigate to the History section on the left menu
2. Use the available filters to narrow down results:
   • Time range
   • Alert ID
   • User
   • Action type
   • Environment
   • Severity

A Bulk Actions menu is also available on this view. Multiple alerts can be managed simultaneously using bulk operations:

1. Select multiple alerts using the checkboxes
2. Choose an action from the bulk actions menu:
   • Export selected alerts
   • Delete selected alerts

History timeline

The history timeline can be accessed by double-clicking on the alert on the History view or by right-clicking on the alert on a regular view. The timeline provides a visual representation of an alert's lifecycle:

• Chronological display of all events
• Color-coding for different types of actions
• Expandable entries for detailed information
• Time elapsed between significant events

Using alert history data

Troubleshooting

History data is invaluable for troubleshooting:

• Understand how an alert progressed
• Identify when specific actions were taken
• See who was involved in handling an alert
• Determine response and resolution times

Accountability

The history system supports accountability by:

• Recording all user actions
• Providing timestamps for all changes
• Maintaining an unalterable audit trail
• Showing the complete chain of events

Performance analysis

History data can be analyzed to improve performance:

• Calculate average time to acknowledgment
• Measure mean time to resolution (MTTR)
• Identify bottlenecks in alert handling
• Compare performance across teams or time periods

Integration with other features

The history tracking integrates with other ToBeAlert features:

• Alert table - Quick access to history from the alert context menu
• User management - Links history records to specific users
• Tools - Records when custom tools are executed on alerts
• Reporting - Provides data for historical reports and analytics

Best practices

For effective use of alert history:

1. Add detailed notes when making significant changes
2. Review history regularly to identify patterns and improvement opportunities
3. Use history data in post-mortems to understand incident timelines
4. Train new team members using historical examples
5. Establish history review procedures for critical alerts

History data retention

ToBeAlert manages history data according to configurable policies:

• Active history - Recent history directly accessible in the UI
• Archived history - Older history that may be stored in compressed form
• Retention period - How long history is kept before being purged
• Export options - Ways to preserve history beyond the retention period

By effectively using the alert history tracking feature, you can maintain accountability, improve processes, and ensure you have the necessary records for both operational and compliance purposes.