Introduction
Create alert generates an alert on a device when an automation runs. Use it to surface conditions that don't have a built-in monitor — a failed compliance check, a detected application, a missing file — as a proper alert that can be reviewed, acknowledged, and acted on through Level's alert workflow.
Create Alert
In Step configuration, fill in the following fields:
Title (required) The alert name shown in the device's alert list and in email notifications. Keep it specific enough to act on: "Disk encryption not detected" beats "Alert."
Description (required) Additional context about the alert. Explain what was detected, what it means, and what the next step is.
Severity Dropdown with four levels: Information, Warning, Critical, and Emergency. Defaults to Information. Set this deliberately — severity drives prioritization and notification routing.
Custom Payload
The Custom payload section lets you attach freeform content to the alert. Type whatever you want — plain text, JSON, key-value pairs — and use the (x) button to insert automation variables that embed device context into the payload at runtime.
ℹ️ NOTE: The payload is included as-is when the alert is triggered. This is useful for integrations or webhooks that consume alert data downstream.
Email Recipients
Under Email recipients, add one or more email addresses to notify when this alert fires.
Enter an address in the Email(s) field.
Press
Tabor type a comma to add additional addresses.Recipients receive an email each time the alert is generated.
💡 TIP: Email recipients here are per-alert-action recipients, not your organization's global notification settings. Use this to route specific automation-generated alerts to the right people without changing broader notification preferences.
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for action name, failure behavior, output variable assignment, retries, and the enabled toggle.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Where do automation-generated alerts appear? On the device's Alerts tab under Device Details, and in the global Alerts view.
What severity levels are available? Information, Warning, Critical, and Emergency. Match the severity to the urgency of the condition being detected.
Can I resolve an automation-generated alert automatically? Automation-generated alerts follow the same resolution workflow as monitor-generated alerts. Manual resolution or a separate automation can handle that.
Is the custom payload the same as a monitor alert payload? Automation-created alerts let you define a custom payload at configuration time. Monitor alerts have their payload set by the monitor's output. They both appear in the alert record, but the source and content differ.
Who can create and view these alerts? Any technician with permission to edit automations can configure this action. Alert visibility follows the same group-level permissions as other device alerts.