Alerts
Alerts are generated automatically when a monitored device crosses a threshold, or when Guardian’s predictive engine detects a developing problem. They appear in the Alerts list in real time and refresh automatically.
Severity levels
Section titled “Severity levels”| Severity | Meaning |
|---|---|
| Critical | Immediate attention required |
| Predictive (ML) | Guardian’s machine-learning engine flagged a likely upcoming issue before it becomes critical |
| Warning | Worth reviewing soon |
| Info | Informational, non-urgent |
Critical and Predictive alerts are highlighted with a pulsing indicator so they stand out in the list.
Filtering and search
Section titled “Filtering and search”The Alerts page has three tabs: Active, Resolved, and All. Within a tab you can:
- Search by alert title or hostname
- Filter by severity
- See how many alerts are currently active in the header
Each alert shows its severity, title, source host, an optional message, and the time it was created.
Root-cause correlation
Section titled “Root-cause correlation”When several alerts fire across different hosts at the same site within a few minutes of each other — the classic pattern for a site-wide event like a switch or power outage — Guardian links the later ones to the earliest as their likely cause. A linked alert shows a ↳ Linked to #N badge pointing at the root alert, so a site-wide event reads as one story instead of a wall of unrelated-looking alerts. This is inventory information only for now — it doesn’t change how alerts are resolved or routed.
Resolving alerts
Section titled “Resolving alerts”Resolving an alert marks it as handled and removes it from the Active view. This requires a Technician or Superadmin role — read-only users can view alerts but not resolve them.
- Resolve a single alert from its row
- Select multiple unresolved alerts with the checkboxes and use Resolve selected to clear them in bulk
- Superadmins can also permanently delete selected alerts
What happens after an alert fires
Section titled “What happens after an alert fires”A critical alert automatically opens a tracked incident if one doesn’t already exist for it, and is routed to your configured notification channels. If the alert matches a scheduled or self-healing action, the response is recorded in the remediation log.