How SIGNL4 supports alert severity

Event and alert severity are extremely important information for an effective alert management and response. Severity information determine the speed of response, needed resource allocation and the action path taken. Naturally, critical alerts have higher priority than major alerts which again overrule minor alerts.

However, as monitoring, security and other control systems have different ways to transport alert severity, an alerting solution like SIGNL4 needs to be flexible enough to digest various severity data coming from an external event source.

Advantages of the SIGNL4 approach

In SIGNL4, the ‘Services & Systems’ categories provide for an extremly powerful and flexible mechanism to map external severity information and translate those into actionable alert signls. Advantages of using SIGNL4 categories to map and display alert severities are:

1. Support for any number of severity levels
2. Can be adapted to almost any severity tagging mechanism a 3rd party tool uses
3. Allows for visual tagging of severities
4. Allows for accoustic tagging through category-related push sounds
5. Flexible subscription mechanism, for instance to get notified only for critical and major alerts while still seeing minor alerts

How it works

SIGNL4 provides for two fundamental ways of translating severity information of external events (e.g. an email sent to SIGNL4) into SIGNL4 alert categories. Firstly, simple keyword search by which SIGNL4 would for instance look for ‘critical’ in the event payload and then tag an alert with the critical category. Secondly, in case external events can be altered, by enforcing SIGNL4 to tag an event with a relating category by using a special parameter in the email/webhook content (e.g. by adding “X-S4-Service: critical” to the email body).

This mechanism allows for as many severity categories as you wish, also in combination with additional event data. As an example one could create three categories in SIGNL4 (critical, major, minor) or one could define multiple categories by combining for instance machine types and severity levels (by using the ‘AND’ option for keywords). As you can see, this allows for almost unlimited customization.

You can create and manage categories in the mobile app if you have the ‘admin’ role in your team.

Demo Implementation Video

The following 3 min video walks you through a basic 3-categories example:

SIGNL4 categories and alert severity on Vimeo.