Introduction
Get alerted when a device goes offline — or comes back online. The Connection monitor watches device reachability and fires an alert when the status you're tracking is breached for longer than your defined threshold.
It's the baseline monitor for any environment. If a device drops off and nobody notices, everything downstream breaks silently.
Connection Monitor
The Connection monitor checks whether devices covered by the policy are online or offline. When the condition you've configured is met — and stays met for the full breach duration — Level creates an alert.
Two conditions are available:
Device goes offline — alert when a device stops reporting to Level
Device comes online — alert when a device returns to an online state (useful for tracking unexpected reboots or unauthorized power-ons)
Configuring Connection Monitor
Open the monitor policy you want to add this to, then click + Add new monitor (or open an existing Connection monitor to edit it). The Edit monitor panel opens on the right.
Name and Type
Enter a name in the Name field. Be specific — something like "Servers - Offline Detection" is more useful than "Connection Monitor" when you're scanning a list of alerts.
Set Type to Connection.
Severity
Set Severity to match how your team should respond to this alert. Four levels are available:
Information — low priority, FYI-level
Warning — worth attention but not urgent
Critical — requires prompt response
Emergency — drop everything
💡 TIP: For server offline alerts, Critical or Emergency is usually appropriate. For workstations, Warning is often enough — a workstation going offline overnight is normal.
Connection Status
Set Connection status to the condition you want to monitor:
Device goes offline — triggers when a device stops reporting
Device comes online — triggers when a device reconnects
Breach Duration
Breach duration controls how long the condition must be true before Level creates an alert. Set it using the slider or the up/down arrows — both adjust the same value. The range is 0 to 120 minutes.
Setting breach duration to 0 fires the alert immediately when the condition is detected. A small buffer (1–5 minutes) cuts down on noise from brief connection blips without meaningfully delaying real alerts.
💡 TIP: A 2–5 minute breach duration works well for most offline alerts. Devices occasionally lose connectivity momentarily during updates, network switches, or agent restarts — a short buffer filters those out without meaningful delay on genuine incidents.
Auto-Resolve
The Auto-resolve alert if it is no longer applicable toggle (enabled by default) automatically closes the alert when the condition clears — meaning the device comes back online (for an offline alert) or goes offline again (for a come-online alert).
Leave this on unless you want alerts to persist for manual review regardless of current state.
Remediation
Optionally attach one or more automations to run automatically when this monitor fires. This is how you trigger a pager, create a ticket, or kick off a recovery script the moment an alert is created.
Click in the Remediation field and select an automation from the list.
To add more, click + Add another remediation.
To remove one, click the × next to it.
Once an automation is attached, open it from the link icon and assign the monitor's payload to an automation variable if you want to pass alert data (device name, timestamp, condition) into the automation's logic.
ℹ️ NOTE: Remediations run when the alert is created, not when it resolves.
Notifications
Two notification toggles control whether policy recipients get emailed:
Send notifications on alert creation — recipients get an email when the alert fires
Send notifications on alert resolution — recipients get an email when the alert auto-resolves or is manually resolved
Recipients are configured at the monitor policy level, not per individual monitor. Go to the Recipients section of the policy to add email addresses.
ℹ️ NOTE: If no recipients are added to the policy, notification emails won't send regardless of these toggle states.
Saving the Monitor
Click Update monitor to save changes to an existing monitor, or Add monitor if you're adding a new one. The monitor list in the policy updates immediately.
FAQ
Who can create and edit monitors? Technicians with access to the relevant monitor policy can create and edit monitors. Policy-level access is controlled by your organization's permission settings. See Workspace → Permissions for details.
Why didn't my alert fire even though a device went offline? Check your breach duration setting. If the device came back online before the breach duration elapsed, no alert will be created. Also confirm the device is covered by the policy's target tags.
Can I use the Connection monitor to detect unexpected reboots? Yes — set Connection status to Device comes online and attach a remediation automation that logs or notifies. A device that reboots unexpectedly will briefly appear offline, then come back online and trigger this monitor.
What's the difference between "Device goes offline" and the device status in the Device Listing? The device listing shows current status in real time. The Connection monitor creates a persistent alert when offline status is sustained beyond your breach duration. The listing will show the device as offline immediately; the alert appears only after the threshold is met.
Can I attach the same automation to multiple Connection monitors? Yes. Automations can be used as remediations across as many monitors as needed. If you're passing monitor payload data into the automation, the payload will reflect whichever monitor triggered it.
What happens to open Connection alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close or remove alerts it already created — you'll need to resolve those manually.