Monitoring & Alerts

Monitoring is the operational layer that turns raw endpoint telemetry into actionable alerts. It is not a passive dashboard - it is an evaluation engine that runs on a schedule, applies threshold conditions over time windows, and opens alerts when those conditions are breached. Every alert is backed by real data collected by the endpoint agent; there is no synthetic or mock data path.

You work with monitoring through monitor policies. A policy groups one or more monitors, the endpoint groups it targets (by tag), and the people who should be notified. The evaluation engine runs every minute, checks each enabled policy against fresh telemetry, and opens or resolves alerts as conditions change.

Close image

A monitor policy is the container that ties monitors, targets, and recipients together. Follow these steps to create one.

1. 1
   Open the Monitoring page

   From the sidebar, expand the Endpoints group and select Monitoring. This opens the monitor policy list, where you can search, sort, and filter existing policies.

2. 2
   Create a new policy

   Click the create button to open the policy form. Give the policy a name and an optional description, then enable it so the evaluation engine will pick it up.

3. 3
   Add monitors

   Inside the policy, switch to the Monitors tab and add one or more monitors. For each monitor, choose a type, set a severity, and configure the threshold and duration window that define when the condition is breached.

4. 4
   Target endpoint groups

   Specify which endpoints the policy applies to by selecting endpoint tags. Every endpoint that carries one of the selected tags becomes a target of the policy and is evaluated by each monitor.

5. 5
   Add notification recipients

   Add the users or email addresses that should be notified when an alert is triggered or resolved. You can choose to notify on alert creation, on resolution, or both.

6. 6
   Optionally attach an automation

   If you want remediation to run automatically, link an automation to a monitor. When that monitor breaches, the automation starts immediately - no manual intervention needed.

Each monitor checks a specific kind of condition against real endpoint data. Resource monitors read telemetry the agent reports every minute; the uptime monitor reads endpoint heartbeats; the event-log monitor reads Windows event logs.

Severity levels

Every monitor carries a severity that indicates how urgent a breach is. Severity is shown on alerts and used for filtering.

Alerts are the runtime output of evaluation. When a monitor’s condition is breached for the full duration window, an alert opens; when the condition clears, the alert resolves. Here is the full lifecycle.

1. 1
   Alert is created

   When a monitor’s threshold is breached for the full duration window, an alert is opened with an active status and a timestamp.

2. 2
   Notifications are sent

   If the monitor is set to notify on creation, an email is sent to every recipient on the policy at the moment the alert opens.

3. 3
   Automation runs (optional)

   If an automation is linked to the monitor, it starts immediately - restarting a service, running a script, or opening a ticket without waiting for a human.

4. 4
   Alert is resolved

   The alert resolves when the condition clears. If auto-resolve is on, the engine closes it automatically; otherwise you can resolve it manually from the policy Activity tab or the endpoint Monitoring tab.

5. 5
   Resolution notification (optional)

   If the monitor is set to notify on resolution, a second email is sent to all recipients confirming the alert has closed.

How alerts are evaluated

• The evaluation engine runs automatically every minute on a schedule - you do not need to trigger it manually.
• For each enabled policy, the engine reads the latest telemetry and event-log data for every targeted endpoint.
• Each monitor applies its threshold condition over the duration window you configured.
• The window must be fully populated with data before a breach is counted - a partially filled window does not trigger an alert, which prevents false positives from gaps in data.
• When a breach is confirmed, an alert is opened with an active status.
• If auto-resolve is enabled for the monitor, the engine automatically resolves the alert as soon as the condition clears.
• If a monitor has an automation attached, the automation run starts the moment the alert is triggered.

While policies give you a global, group-level view, sometimes you need to focus on a single endpoint. Every endpoint’s detail page has a Monitoring tab that shows exactly what applies to that endpoint and what has happened to it.

• Open any endpoint’s detail page and switch to the Monitoring tab to see a per-endpoint view.
• The Assigned Monitors card lists every monitor that targets this endpoint (through its tags), with toggles to enable or disable each one.
• You can add a monitor directly from this view by selecting a policy that already targets the endpoint, then configuring the monitor in the drawer.
• The alert history shows only this endpoint’s alerts, with filters for status, severity, and monitor, plus a date range picker and pagination.
• Alerts can be acknowledged or resolved directly from the endpoint view - you do not need to navigate back to the policy page.
• Data is loaded on demand as you open the tab, so large endpoint lists stay fast.