Introduction
New Level accounts come with a monitor policy already configured and ready to assign to devices. Before you start adding monitors from scratch, take a few minutes to review what's already there — it covers the most common checks out of the box.
Default Monitor Policy
Navigate to Monitors in the left sidebar. You'll see a list of your monitor policies. New accounts include one called Monitoring - Global.
Click Monitoring - Global to open it.
What's Included
The policy opens with two panels: Targets on the left (which devices this policy watches) and the monitor list on the right.
The policy includes 10 monitors covering the most common checks:
Monitor | Type | Default Threshold | Severity |
BSOD / Unexpected Shutdown | Event log | 1 occurrence / 1 hour | Warning |
CPU Monitor | CPU usage | Greater than 75% / 10 minutes | Warning |
Critical Service Crashed | Event log | 1 occurrence / 1 hour | Warning |
Disk I/O Error | Event log | 1 occurrence / 1 hour | Warning |
Disk Monitor - Critical | Disk usage | Less than 10% free / any drive | Critical |
Disk Monitor - Warning | Disk usage | Less than 20% free / any drive | Warning |
Linux Uptime Exceeds 30 Days | Script (OsQuery) | 1 occurrence / 1 hour | Information |
macOS Uptime Exceeds 30 Days | Script (OsQuery) | 1 occurrence / 1 hour | Information |
Memory Monitor | Memory usage | Greater than 75% / 10 minutes | Warning |
Windows Uptime Exceeds 30 Days | Script (OsQuery) | 1 occurrence / 1 hour | Information |
These cover the fundamentals: resource saturation, disk health, unexpected shutdowns, and uptime tracking. For most environments, this gets you most of the way there on day one.
Assigning the Policy to Devices
The policy does nothing until it's assigned to devices. Targets are set by tag.
By default, the policy targets WORKSTATION and SERVER tags. If your tags use different names, click the + button in the Targets panel and add the tags you're using.
ℹ️ NOTE: The "0 devices" count shown next to each tag in the screenshot reflects a fresh account with no enrolled devices yet. Once devices are tagged and enrolled, the count updates.
Adding Alert Recipients
By default, the policy fires alerts visible in the Level Alerts view, but doesn't send email notifications unless you configure recipients.
In the Recipients panel on the left, click + and add the email addresses that should receive alerts from this policy.
💡 TIP: You can add different recipients to different policies. For example, a security-focused policy might notify your security team while a general monitoring policy goes to your whole IT team.
Adjusting Individual Monitors
The defaults are reasonable starting points, but your environment may need different thresholds. Click any monitor in the list to open its configuration.
Common adjustments to consider:
CPU Monitor — 75% over 10 minutes is a reasonable default. On servers with consistently high CPU load, you may want to raise this to avoid noise.
Memory Monitor — Same as CPU. Adjust if your devices run memory-intensive workloads.
Disk Monitor - Warning — 20% free is the default warning threshold. For large drives (2 TB+), a percentage threshold can be misleading. Consider whether an absolute value makes more sense for your environment.
Uptime monitors — 30 days is a common threshold for flagging a device that hasn't been restarted. Adjust if your environment has different expectations.
⚠️ WARNING: Lowering thresholds too aggressively (e.g., CPU > 50% for 1 minute) will generate significant alert volume. Tune conservatively and adjust based on what you're actually seeing.
Connecting Monitors to Automations
Monitors can trigger automations automatically when they fire — no manual intervention needed. This is called a remediation. You configure it directly on the monitor.
Click any monitor in the list to open its configuration, then add a remediation automation. When the monitor's threshold is met and an alert fires, Level runs the linked automation against that device.
Two pairings that work well with the default policy right out of the box:
Uptime monitors → Prompt User to Restart The Linux, macOS, and Windows Uptime Exceeds 30 Days monitors fire an Information alert when a device hasn't been restarted in over a month. Link the Prompt User to Restart automation from the Get Started group as the remediation. When the monitor fires, it prompts the end user to restart — no ticket, no manual follow-up.
Disk monitors → Disk Cleanup The Disk Monitor - Warning (less than 20% free) is a natural trigger for the Disk Cleanup automation. When disk space drops below the threshold, the automation runs cleanup automatically and may resolve the alert before anyone has to look at it.
💡 TIP: Pair the Warning threshold monitor with Disk Cleanup as remediation, and keep the Critical threshold monitor as an alert-only escalation for when cleanup wasn't enough.
Creating Additional Policies
The Monitoring - Global policy is a baseline. As you get more specific — monitoring a particular service, watching for a security event, tracking a custom metric — you'll build additional policies and assign them to narrower device sets.
See Getting Started with Monitors for a full walkthrough of creating monitor policies, adding script monitors, and building a layered monitoring strategy.
FAQ
The policy shows "0 devices" — is something wrong? No. That count reflects how many devices currently have the target tag applied. Once you enroll devices and your tagging automation runs, the count updates. If you've already enrolled devices and the count is still 0, check that your devices have the "WORKSTATION" or "SERVER" tags applied.
Can I rename the Monitoring - Global policy? Yes — click into the policy and edit the name. The name is just a label.
Can I delete monitors from the policy I don't need? Yes. Click the three-dot menu next to any monitor and remove it. The Uptime monitors, for example, are Information severity — if you're tracking uptime a different way, removing them reduces noise.
Can multiple policies apply to the same device? Yes. Monitor policies stack — a device can be covered by multiple policies simultaneously. You'll see all active monitors for a device in the Monitors tab of the device detail view.