Introduction
See every active and resolved alert across all your devices, inspect what triggered them, and act — resolve alerts, run automations, or execute scripts — without touching individual device pages. The Alerts global view is where you triage at scale.
This is the global version of the per-device Alerts tab. For alerts scoped to a single device, see Devices → Device Details → Alerts.
Global Alerts
Select Alerts from the main sidebar. The page opens to the Active tab by default. The badge on the sidebar item shows the current active alert count.
Filtering by Device Group
The left panel lists all your device groups. Selecting a group scopes both tabs to alerts from devices in that group only. Select All devices at the top to return to the unfiltered view.
ℹ️ NOTE: Group selection persists when you switch between Active and Resolved.
Active Alerts
The Active tab lists every open alert across all your devices. Each row shows:
Severity — the alert level set on the monitor: Information, Warning, Critical, or Emergency
Trigger details — the monitor name and the condition that fired (e.g., "Disk free < 10.0%")
Alert started — when the alert first opened
Device — which device fired the alert, with its group path breadcrumb (e.g.,
IT > Infrastructure)Automation ran — if a remediation automation was linked to the monitor, its name appears here; click it to view that automation run's details
Alert Payload
Click the › chevron on any row to expand the alert payload. What you see depends on the monitor type:
CPU monitors show the top processes by CPU usage at the time the alert triggered
Memory monitors show the top processes by memory consumption
Script monitors show the raw output your script returned
Event Log monitors show the matching event details, including Event ID, source, and message
The payload is captured when the alert opens and stays static while the alert remains open. If the alert is resolved and reopens, the payload updates to reflect conditions at the new trigger time.
Searching and Filtering
Use the Search bar to filter by monitor name or trigger text. Click Filters to narrow by Severity, Device platform, or Device operating system. Click Columns to show or hide fields — Alert source is hidden by default and shows which monitor policy originated the alert.
Taking Action on Alerts
Resolving Alerts
To resolve a single alert, open its row context menu (the ⋮ icon at the far right) and select Resolve.
💡 TIP: If the monitor has Auto-resolve enabled, Level closes the alert automatically once the condition clears. Manual resolution is most useful for alerts that don't auto-resolve, or when you want to clear noise while investigating.
To resolve multiple alerts, check the boxes next to the rows you want, then click Resolve in the toolbar. The footer shows a count of selected alerts (e.g., "2 active alerts selected of 15"). Toggle Show only selected to narrow the table to your selection before confirming.
ℹ️ NOTE: Resolving an alert marks it as closed. If the same monitor condition fires again within 24 hours, Level reopens the existing alert rather than creating a new one, and keeps the original start timestamp. After 24 hours without re-triggering, Level creates a fresh alert.
Running Automations and Scripts
When you have alerts selected, the Actions dropdown in the toolbar lets you act on the affected devices directly from this view — without navigating to each device. This is the fastest way to kick off remediation across multiple devices at once.
Click Actions to open the menu:
Run automation — trigger an existing automation against the selected devices
Run saved script — run a script from your script library
Run new script — write and run a new script on the fly
Add to recent script run — attach the selected devices to a script run already in progress
The same options are available on a single alert via the row context menu, alongside Resolve.
💡 TIP: A common workflow: filter alerts by severity to isolate Criticals, select all, run a diagnostic script via Actions → Run saved script, then review output before deciding whether to resolve.
Resolved Alerts
The Resolved tab shows every alert that's been closed — by a technician, an automation, or auto-resolve. Alerts are stored indefinitely.
The resolved table adds two columns not present on the Active tab:
Alert resolved — when the alert was closed
Resolved by — who or what closed it: a technician's name, "Auto-resolved" if the monitor's auto-resolve fired, or blank if resolved via automation
Expand any resolved alert row to see its payload. Use Search, Filters, and Columns to narrow the view.
💡 TIP: Use the resolved tab to spot recurring issues. If the same monitor is cycling through the same devices repeatedly, that's a signal to investigate the root cause or adjust the monitor threshold.
FAQ
How is this different from the Alerts tab on a device's detail page? The device-level tab shows alerts for one device only. This view shows alerts across all your devices (or a selected group) and lets you act on multiple devices at once.
Who can resolve alerts and run actions from this view? Any technician with permissions for a device's group can resolve alerts and run actions on that device. The view only shows devices the signed-in technician has access to.
Why did an alert disappear from Active but I can't find it under Resolved? Level reopens an existing alert if the same monitor fires again within 24 hours. When it reopens, it goes back to Active — and it keeps the original start timestamp, so the timing can look confusing. Check the Active tab and look for an older start date on a current alert.
What does "Automation ran" show if no automation was linked to the monitor? It shows
--. An automation only appears there if the monitor that triggered the alert had a remediation automation configured.The alert payload is blank — why? Some monitor types don't generate a payload. Connection monitors (offline alerts) and some process/service monitors may show no payload beyond the trigger condition. Script monitors only populate a payload if your script outputs text to stdout.
Can I filter to just Critical alerts across a specific group? Yes. Select the group from the left panel, then use Filters → Severity to show only Critical alerts within that group.