/alerts

name: "Atera Alerts"
description: >
  Atera alerts: alert types, severity levels, alert sources, the
  acknowledge/resolve lifecycle, and alert-to-ticket conversion.
when_to_use: >-
  When viewing, acknowledging, resolving, or managing alerts raised by
  Atera-monitored devices. Use when: atera alert, rmm alert, monitoring
  alert, alert severity, alert acknowledge, alert resolve, device alert,
  threshold alert, or atera monitoring.

Atera Alert Management

Overview

Alerts in Atera are notifications generated when monitored systems exceed defined thresholds or encounter issues. They serve as the early warning system for MSPs, enabling proactive response to client issues before they become critical problems.

Anti-triggers

• **The work the alert generated** — an alert promoted into a service

desk record is a ticket; use `atera-tickets`.

• **What raises the alert** — thresholds and monitor configuration are

`atera-devices` for agentless monitors and `atera-agents` for endpoint health.

• **Alerts from a different RMM** — `superops-alerts`,

`ninjaone-alerts`, `datto-rmm-alerts`, `connectwise-automate-alerts`, and N-central active issues (`ncentral-monitoring-tasks`) are separate stores with their own severity scales. Nothing here reads them, and the counts are not comparable.

• **A security detection** — endpoint threat findings come from the EDR,

not the RMM; use `huntress-incidents`, `sentinelone-alerts`, or `rocketcyber-incidents`.

Alert Severity Levels

| Severity | Description | Typical Response | |----------|-------------|------------------| | **Critical** | Immediate action required | Respond within 15 minutes | | **Warning** | Attention needed soon | Respond within 1 hour | | **Information** | FYI, no action required | Review during normal hours |

Alert Sources

| Source | Description | |--------|-------------| | **Agent** | Alerts from RMM agent monitoring | | **Device** | Alerts from HTTP/SNMP/TCP monitors | | **Threshold** | Alerts when metrics exceed limits | | **Custom** | User-defined or API-created alerts |

Alert Types

| Type | Description | Common Triggers | |------|-------------|-----------------| | **Availability** | Device/service up/down | Agent offline, ping failure | | **Performance** | Resource utilization | High CPU, low memory, disk full | | **Hardware** | Physical component issues | SMART errors, temperature | | **Security** | Security-related events | Failed logins, malware detected | | **Application** | Software issues | Service stopped, event log errors | | **Patch** | Update status | Missing patches, update failures | | **Backup** | Backup status | Backup failed, missed schedule |

Alert Fields

Core Fields

| Field | Type | Description | |-------|------|-------------| | `AlertID` | int | Unique alert identifier | | `Code` | int | Alert type code | | `Source` | string | Alert source (Agent, Device, etc.) | | `Title` | string | Alert title/summary | | `Severity` | string | Critical, Warning, Information | | `Created` | datetime | When alert was generated | | `SnoozedEndDate` | datetime | Snooze expiration (if snoozed) | | `DeviceGuid` | string | Associated device GUID | | `AdditionalInfo` | string | Extra context/details | | `Archived` | boolean | Whether alert is archived | | `AlertCategoryID` | string | Category classification | | `ArchivedDate` | datetime | When alert was archived | | `TicketID` | int | Linked ticket (if converted) | | `AlertMessage` | string | Detailed alert message | | `FolderID` | int | Folder/group reference |

Device/Customer Fields

| Field | Type | Description | |-------|------|-------------| | `CustomerID` | int | Associated customer ID | | `CustomerName` | string | Customer display name | | `DeviceName` | string | Device hostname |

API Patterns

List All Alerts (Paginated)

GET /api/v3/alerts?page=1&itemsInPage=50
X-API-KEY: {api_key}

**Response:**

{
  "items": [
    {
      "AlertID": 111111,
      "Code": 205,
      "Source": "Agent",
      "Title": "High CPU Usage",
      "Severity": "Warning",
      "Created": "2024-02-15T10:30:00Z",
      "CustomerID": 12345,
      "CustomerName": "Acme Corporation",
      "DeviceName": "SERVER-DC01",
      "DeviceGuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "AlertMessage": "CPU usage exceeded 90% for 5 minutes",
      "Archived": false,
      "TicketID": null
    }
  ],
  "totalItems": 250,
  "page": 1,
  "itemsInPage": 50,
  "totalPages": 5
}

Get Alert by ID

GET /api/v3/alerts/{alertId}
X-API-KEY: {api_key}

**Response:**

{
  "AlertID": 111111,
  "Code": 205,
  "Source": "Agent",
  "Title": "High CPU Usage",
  "Severity": "Warning",
  "Created": "2024-02-15T10:30:00Z",
  "CustomerID": 12345,
  "CustomerName": "Acme Corporation",
  "DeviceName": "SERVER-DC01",
  "DeviceGuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "AlertMessage": "CPU usage has exceeded 90% threshold\n\nCurrent Value: 95%\nThreshold: 90%\nDuration: 5 minutes",
  "AdditionalInfo": "Process: sqlservr.exe consuming 85% CPU",
  "Archived": false,
  "ArchivedDate": null,
  "TicketID": null,
  "SnoozedEndDate": null,
  "AlertCategoryID": "performance"
}

Create Alert (API-Generated)

POST /api/v3/alerts
X-API-KEY: {api_key}
Content-Type: application/json

{
  "DeviceGuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "Title": "Custom Alert - Database Connection Pool Exhausted",
  "Severity": "Critical",
  "AlertMessage": "Application database connection pool at 100% capacity. New connections being rejected.",
  "AlertCategoryID": "application"
}

**Response:**

{
  "ActionID": 111112,
  "AlertID": 111112
}

Delete/Resolve Alert

DELETE /api/v3/alerts/{alertId}
X-API-KEY: {api_key}

**Response:**

{
  "ActionID": 111111,
  "Success": true
}

Alert to Ticket Conversion

Workflow

1. **Review alert** - Understand the issue 2. **Create