Introduction
The Monitors tab in device details shows every monitor currently active on a device — across all policies, all tags, all sources. You can see what's watching the device, what triggered each monitor, and disable individual monitors for this device without changing anything in the underlying policy.
For creating and configuring monitor policies, see Monitors in the main navigation.
Device Monitors
Open any device and click Monitors in the left nav. You'll land on the Monitors tab by default.
Every row is a single monitor that's currently applied to this device. Monitors arrive here through policies, and policies arrive through tags. A device with five tags might pull in monitors from three different policies — they all show up in one flat list here.
The table columns:
Name — the monitor's name as defined in the policy
Policy — which monitor policy the monitor belongs to
Type — the monitor type (CPU usage, disk usage, event log, run script, etc.)
Threshold/Duration — the condition that triggers an alert
Severity — the alert severity level (Information, Warning, Critical)
Remediations — any remediation automation assigned to the monitor
Auto-resolve — whether the alert closes automatically when the condition clears
Notifications — whether notifications are enabled for this monitor
Policies
Click the Policies tab to see which monitor policies are assigned to this device and how they got there.
Each row shows:
Name — the monitor policy name
Applied by — the tag that caused this policy to apply to the device
Date applied — when the policy was first applied
This view answers the question "why is this device being monitored by X?" Every policy here traces back to a tag. Add the tag, inherit the policy. Remove the tag, the policy (and all its monitors) goes with it.
How Tags Connect Policies to Devices
Tags are the mechanism that links monitor policies to devices. When you apply a tag to a device, Level checks whether any monitor policies target that tag, then applies those policies automatically.
The same tag can also trigger automations. A tag called S1 might apply a monitor policy that watches SentinelOne health — and that same tag could also trigger an automation that installs SentinelOne. The monitor could even call a remediation automation if SentinelOne goes unhealthy. One tag, multiple moving parts, all coordinated.
ℹ️ NOTE: Monitor policies are configured and managed under Monitors in the main navigation. The Policies tab here is read-only — it shows what's applied, not where to configure it.
Disabling a Monitor for This Device
You can disable any individual monitor on a device without touching the policy it came from. This is useful when a specific device generates noise for a monitor that's valid everywhere else — a known hardware quirk, a one-off exception, a device in an unusual state.
Find the monitor you want to disable in the Monitors tab.
Click the ⋮ (more options) menu at the end of the row.
Click Disable monitor.
⚠️ WARNING: Disabling a monitor here won't generate alerts for this device, even if the monitored condition is triggered. Make sure disabling is intentional — there's no expiry or automatic re-enable.
The monitor goes inactive on this device only. The policy is unchanged. Every other device that inherits the same policy keeps monitoring normally.
💡 TIP: If you need to suppress alerting temporarily across the whole device (planned maintenance, a known issue window), use Maintenance Mode instead. It pauses all monitors and automations for a set duration without requiring you to disable anything individually.
Editing a Monitor from This View
The ⋮ menu also surfaces an Edit option. This opens the monitor configuration within its source policy.
ℹ️ NOTE: Edits made here apply to the monitor in its policy — which means every device that inherits that policy will see the change. If you need different thresholds for a specific device, the right approach is a separate monitor policy targeted at a more specific tag.
FAQ
Why are monitors showing up on this device that I didn't add directly? Monitors come from policies, and policies apply through tags. If a device has a tag that's targeted by a monitor policy, all the monitors in that policy appear here. Check the Policies tab to see exactly which tags are pulling in which policies.
Who can disable monitors on a device? Any technician with write access to the device's group can disable individual monitors. Permissions are configured per group under Workspace → Permissions.
If I disable a monitor here, will it re-enable automatically? No. A disabled monitor stays disabled on that device until a technician manually re-enables it. There's no expiry or automatic reset.
A monitor keeps firing on one device but not others. What should I check? Start with the Alerts tab on the device to see the alert payload — Level captures the exact values at trigger time. Compare the monitor's threshold in the policy against the device's actual metrics. If the device is a legitimate exception, disable the monitor here or use a more specific tag to create a targeted policy with different thresholds.
What's the difference between disabling a monitor here and putting the device in Maintenance Mode? Disabling a monitor suppresses one specific check, permanently, on this device. Maintenance Mode pauses all monitors and automations for a defined time window. Use Maintenance Mode for scheduled work; use per-monitor disable for permanent exceptions.
Can I see monitor history or past alert values from this tab? The Monitors tab shows current configuration and state. For historical alerts and their payloads, go to the Alerts tab on the same device.