---
title: "Create alert rules"
description: "Decide who is notified about which alerts by matching category, severity, and endpoint to notification channels, with optional escalation steps."
url: "https://support.outpostplatform.com/service-desk/alert-rules/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Alerts > Rules in the Outpost console. A rule matches alerts by minimum severity, categories (none means all), and endpoints (none means all), and sends to channels, by default again when the condition clears. Every matching enabled rule sends. Escalation steps come from the first matching rule, run a set number of minutes after the alert was raised, and are skipped once acknowledged."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "alert:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/service-desk/alert-rules.md"
license: "CC BY 4.0"
---

# Create alert rules

An alert rule decides who hears about an alert. It matches alerts by
severity, category, and endpoint, and sends a notification to the channels you
choose. This page shows how to create a rule and add escalation steps, so the
right person is told and a second person is told if nobody takes the alert.

A rule does not decide what counts as an alert. Thresholds such as disk space
percentages and offline minutes are policy settings on the endpoint's profile.
See [Alerts](/service-desk/alerts/#how-alerts-are-raised).

Until at least one rule exists, alerts are raised and recorded but nobody is
notified.

## Before you begin

- You need `alert:manage`. See
  [Roles and permissions](/depot/roles-and-permissions/).
- Create at least one notification channel. A rule cannot be saved without
  one. See [Notification channels](/service-desk/notification-channels/).

## How rules match

A rule covers an alert when all three of these are true:

- The alert's severity is at or above the rule's **Minimum severity**.
- The alert's category is one of the rule's **Categories**. With no category
  ticked, the rule covers every category.
- The alert's endpoint is one of the rule's **Endpoints**. With no endpoint
  chosen, the rule covers every endpoint.

Every enabled rule that covers an alert sends its notifications, so one alert
can reach several channels through several rules. A channel that more than one
rule names gets one message, not several. Escalation steps are different: an
alert takes its steps from the first rule that covers it, in the order the
**Order** column shows.

Some alerts belong to no endpoint, such as project budget alerts and most
documentation reminders. Only a rule with no endpoints chosen covers them.

Disk alerts are raised per drive, not per endpoint, so an endpoint with two
drives low on space raises two alerts and a rule sends a notification for
each. See
[What disk, memory, and CPU alerts measure](/service-desk/alerts/#what-disk-memory-and-cpu-alerts-measure).

## Create a rule

1. Select **Alerts** > **Rules**, then **New rule**. On the MSP plan, open the
   client first.
2. In **Name**, enter what the rule is for, such as "Critical disk to the
   on-call phone".
3. Leave **Enabled** selected.
4. In **Minimum severity**, choose the lowest severity the rule covers:
   **info and above**, **warning and above**, or **critical and above**.
5. Under **Categories**, tick the categories the rule covers, or leave them all
   clear to cover every category.
6. Under **Endpoints**, search by hostname and tick the endpoints the rule
   covers, or leave none chosen to cover every endpoint.
7. Under **Channels**, tick at least one channel. These are told the moment an
   alert is raised.
8. **Tell the same channels when the condition clears** is selected by
   default and sends a message when the condition clears. For a PagerDuty
   channel, this is what resolves the PagerDuty incident. Clear it to send
   nothing on clear.
9. Select **Save rule**.

## Add escalation steps {#escalation}

An escalation step tells more channels if nobody acknowledges the alert in
time. Steps are optional.

1. Open the rule with **Edit**.
2. Under **Escalation**, select **Add escalation step**.
3. In **After (minutes)**, enter how long after the alert was raised the step
   runs. Each step counts from when the alert was raised, not from the step
   before it.
4. Tick the channels the step notifies.
5. Repeat for each further step, then select **Save rule**.

When somebody acknowledges the alert, steps that have not run yet are skipped.

## Turn a rule off or delete it

- To stop a rule without losing it, clear its **Enabled** checkbox in the
  list. The **Switched off** view lists every disabled rule.
- To delete a rule, select **Delete**, then confirm. Alerts it covered stop
  notifying anybody through it.

## Verify

1. Select **Alerts** > **Notification channels** and select **Test** on each
   channel the rule uses. The **Last result** column shows **Test message
   sent.** when the channel works.
2. When an alert the rule covers is raised, open it. The **Who was told** card
   lists a notification for each channel.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| Nobody was notified about an alert | No enabled rule covers its severity, category, and endpoint. | Check the **Switched off** view, then widen a rule or add one. |
| A project or documentation alert notified nobody | The only matching rules choose specific endpoints. | Add a rule with no endpoints chosen for those categories. |
| A channel was notified but the message never arrived | The channel is disabled, or its address, URL, or key is wrong. | Test the channel. See [Notification channels](/service-desk/notification-channels/). |

## Next steps

- [Notification channels](/service-desk/notification-channels/)
- [Alerts](/service-desk/alerts/)