SuperOps.ai Alert Management

Overview

SuperOps.ai RMM generates alerts when monitored conditions are triggered on managed assets. Alerts can indicate hardware issues, software problems, security events, or custom monitoring conditions. This skill covers alert listing, filtering, acknowledgment, resolution, and automated workflows.

Alert Severity Levels

Alert Status Values

Common Alert Types

Key Alert Fields

Core Fields

Association Fields

Resolution Fields

GraphQL Operations

List Alerts

query getAlertList($input: ListInfoInput!) {
  getAlertList(input: $input) {
    alerts {
      alertId
      message
      severity
      status
      type
      createdTime
      acknowledgedTime
      resolvedTime
      asset {
        assetId
        name
        status
      }
      client {
        accountId
        name
      }
      site {
        id
        name
      }
      acknowledgedBy {
        id
        name
      }
      ticket {
        ticketId
        ticketNumber
      }
    }
    listInfo {
      totalCount
      hasNextPage
      endCursor
    }
  }
}

Variables - Active Critical Alerts:

{
  "input": {
    "first": 50,
    "filter": {
      "status": "Active",
      "severity": ["Critical", "High"]
    },
    "orderBy": {
      "field": "createdTime",
      "direction": "DESC"
    }
  }
}

Variables - Alerts by Client:

{
  "input": {
    "first": 100,
    "filter": {
      "client": {
        "accountId": "client-uuid"
      },
      "status": ["Active", "Acknowledged"]
    }
  }
}

Variables - Alerts by Type:

{
  "input": {
    "filter": {
      "type": "Disk Space",
      "status": "Active"
    }
  }
}

Get Alerts for Specific Asset

query getAlertsForAsset($input: AssetDetailsListInput!) {
  getAlertsForAsset(input: $input) {
    alerts {
      alertId
      message
      severity
      status
      type
      createdTime
      monitor {
        id
        name
        type
      }
    }
    listInfo {
      totalCount
      hasNextPage
    }
  }
}

Variables:

{
  "input": {
    "assetId": "asset-uuid",
    "first": 50,
    "filter": {
      "status": ["Active", "Acknowledged"]
    }
  }
}

Get Single Alert Details

query getAlert($input: AlertIdentifierInput!) {
  getAlert(input: $input) {
    alertId
    message
    severity
    status
    type
    createdTime
    acknowledgedTime
    resolvedTime
    asset {
      assetId
      name
      ipAddress
      status
      client {
        accountId
        name
      }
    }
    monitor {
      id
      name
      type
      threshold
      condition
    }
    acknowledgedBy {
      id
      name
      email
    }
    resolvedBy {
      id
      name
      email
    }
    resolutionNotes
    ticket {
      ticketId
      ticketNumber
      status
    }
    history {
      timestamp
      action
      performedBy {
        name
      }
      notes
    }
  }
}

Acknowledge Alerts

mutation acknowledgeAlerts($input: AcknowledgeAlertsInput!) {
  acknowledgeAlerts(input: $input) {
    success
    acknowledgedCount
    alerts {
      alertId
      status
      acknowledgedTime
      acknowledgedBy {
        id
        name
      }
    }
  }
}

Variables - Single Alert:

{
  "input": {
    "alertIds": ["alert-uuid"],
    "notes": "Investigating disk space issue on server"
  }
}

Variables - Bulk Acknowledge:

{
  "input": {
    "alertIds": ["alert-1", "alert-2", "alert-3"],
    "notes": "Bulk acknowledgment - scheduled maintenance window"
  }
}

Resolve Alerts

mutation resolveAlerts($input: ResolveAlertInput!) {
  resolveAlerts(input: $input)
}

Variables:

{
  "input": {
    "alertIds": ["alert-uuid"],
    "resolutionNotes": "Cleared temp files, disk space now at 45% free"
  }
}

Create Ticket from Alert

mutation createTicketFromAlert($input: CreateTicketFromAlertInput!) {
  createTicketFromAlert(input: $input) {
    ticketId
    ticketNumber
    subject
    status
    alert {
      alertId
      status
    }
  }
}

Variables:

{
  "input": {
    "alertId": "alert-uuid",
    "subject": "Critical: Low disk space on ACME-SERVER01",
    "priority": "HIGH",
    "techGroup": {
      "name": "Service Desk"
    },
    "additionalNotes": "Auto-generated from monitoring alert"
  }
}

Common Workflows

Alert Triage Workflow

# Step 1: Get all active critical alerts
query getCriticalAlerts {
  getAlertList(input: {
    filter: {
      status: "Active",
      severity: "Critical"
    },
    orderBy: { field: "createdTime", direction: "ASC" }
  }) {
    alerts {
      alertId
      message
      asset { name }
      client { name }
      createdTime
    }
  }
}

# Step 2: Acknowledge alert being worked
mutation acknowledgeAlert {
  acknowledgeAlerts(input: {
    alertIds: ["alert-uuid"],
    notes: "Investigating issue"
  })
}

# Step 3: Create ticket if needed
mutation createTicket {
  createTicketFromAlert(input: {
    alertId: "alert-uuid",
    priority: "CRITICAL"
  })
}

# Step 4: Resolve when fixed
mutation resolveAlert {
  resolveAlerts(input: {
    alertIds: ["alert-uuid"],
    resolutionNotes: "Issue resolved - rebooted service"
  })
}

Alert Summary Dashboard

query getAlertSummary {
  criticalAlerts: getAlertList(input: {
    filter: { status: "Active", severity: "Critical" }
  }) {
    listInfo { totalCount }
  }
  highAlerts: getAlertList(input: {
    filter: { status: "Active", severity: "High" }
  }) {
    listInfo { totalCount }
  }
  acknowledgedAlerts: getAlertList(input: {
    filter: { status: "Acknowledged" }
  }) {
    listInfo { totalCount }
  }
  recentResolved: getAlertList(input: {
    filter: { status: "Resolved" },
    first: 10,
    orderBy: { field: "resolvedTime", direction: "DESC" }
  }) {
    alerts {
      alertId
      message
      resolvedTime
      asset { name }
    }
  }
}

Client Alert Report

query getClientAlertReport($clientId: ID!, $startDate: DateTime!, $endDate: DateTime!) {
  getAlertList(input: {
    filter: {
      client: { accountId: $clientId },
      createdTime: {
        gte: $startDate,
        lte: $endDate
      }
    }
  }) {
    alerts {
      alertId
      message
      severity
      status
      type
      createdTime
      resolvedTime
      asset { name }
    }
    listInfo { totalCount }
  }
}

Error Handling

Common Errors

Status Transition Rules

// Valid alert status transitions
const validTransitions = {
  'Active': ['Acknowledged', 'Resolved'],
  'Acknowledged': ['Resolved', 'Active'],  // Can un-acknowledge
  'Resolved': ['Active'],  // Can reopen if issue returns
  'Auto-Resolved': ['Active']  // Can reopen
};

function canTransition(currentStatus, newStatus) {
  return validTransitions[currentStatus]?.includes(newStatus) || false;
}

Best Practices

1. Acknowledge promptly - Show clients issues are being tracked
2. Create tickets for complex issues - Link alert to ticket for tracking
3. Document resolutions - Helps with recurring issues
4. Use bulk operations - Efficient handling of multiple alerts
5. Set up auto-resolution - Let transient issues clear themselves
6. Filter by severity - Focus on critical alerts first
7. Monitor acknowledgment time - Track response SLAs
8. Review alert patterns - Identify recurring problems

Related Skills

• SuperOps.ai Assets - Asset details
• SuperOps.ai Tickets - Create tickets from alerts
• SuperOps.ai Runbooks - Automated remediation
• SuperOps.ai Clients - Client associations
• SuperOps.ai API Patterns - GraphQL patterns