Monitor policies define what Level watches on your devices and who gets notified when something goes wrong. Each policy bundles one or more monitors, a set of target tags, and a list of alert recipients — so you can apply a coherent set of checks to any group of devices just by tagging them.

This article covers how policies work, how to create and configure them, and which monitor types are available. For configuration details on specific monitor types, see the linked articles in each section below.

A monitor policy has three parts:

When a monitor's threshold is exceeded, Level opens an alert and (if configured) emails the recipients. If Resolución automática is enabled on that monitor, the alert closes automatically once the condition clears. If it's off, a technician must manually resolve it from the Alertas view.

Tags are the mechanism that links policies to devices. Apply a tag to a device, and Level immediately checks whether any monitor policies target that tag — then applies those policies automatically. Quitar the tag and those policies stop monitoring that device. The Monitores tab on a device's detail page shows every monitor currently active on it, across all policies and tags, in a single flat list. See Dispositivo Detalles → Monitores for more.

Navigate to Monitores in the sidebar. The Monitor policies page lists every policy in your organization.

Each row shows:

To customize which columns appear, click Columnas in the top right. On the policies listing, you can toggle: Nombre, Creard, Creard by, Last edited, and Last edited by.

To delete one or more policies, check the box next to each row and click Eliminar.

The new policy opens immediately. You'll land on the policy detail view, ready to add targets and monitors.

The Targets panel on the left side of a policy controls which devices it monitors. Targets are tag-based — add a tag here and every device carrying that tag gets monitored by this policy.

To add a target tag:

To remove a target tag:

Haga clic en el three-dot menu next to a tag in the Targets panel and select Quitar target.

The Recipients panel sits below Targets on the left side. Recipients receive email notifications when monitors in this policy trigger or resolve alerts.

To add recipients:

To remove a recipient:

Haga clic en el three-dot menu next to a recipient's email and select Quitar recipient.

The right side of the policy shows all monitors attached to it. This is where you see what the policy is actually checking.

Default columns visible in the table:

Three additional columns are available but hidden by default. Haga clic en Columnas to enable them:

Haga clic en + Añadir new monitor in the top right of the policy view. This opens a monitor configuration panel where you choose the monitor type and set its parameters.

The available monitor types fall into two categories:

These watch standard system metrics without requiring any script:

Monitores de script run a PowerShell, Bash, or Python script on the device and evaluate the output against a configured condition. Use these for anything the built-in types don't cover — software license checks, custom application health, registry values, and so on.

When a monitor's threshold is breached, Level opens an alert and captures a payload reflecting device state at the time of the trigger. What's in that payload depends on the monitor type:

The payload stays live and synced for as long as the alert is open. Once the alert resolves, Level freezes it — preserving the last bad state at the moment of resolution. That frozen snapshot is what you see when you expand a resolved alert.

To view and triage alerts across all devices, go to the Alertas global view. To see alerts scoped to a single device, open the device and click the Alertas tab. See Alertas and Dispositivo Detalles → Alertas for details.

Haga clic en Actions in the top right of a policy to access:

Level's Resource Library has hundreds of ready-to-use monitor policies and scripts built by the Level team and the community. Any of them can be imported directly into your account with one click — no configuration required to get started.

A few patterns that hold up in practice:

Keep policies role-focused. Split resource monitoring (CPU, memory, disk) from application monitoring (services, processes). A domain controller policy should only monitor domain controller functions — not generic workstation metrics.

Match policy names to tag names. If your tag is "Exchange", name the policy "Exchange Monitoring". The pairing is obvious and makes auditing easier.

Deshabilitar auto-resolve selectively. Leave auto-resolve off only when you want a technician to investigate the root cause. If it's off everywhere, unresolved alerts pile up and create noise.

Don't overload a single policy. Level supports multiple policies per device via tag overlap. A device can receive checks from a "Workstations - Resources" policy and a "Huntress" policy simultaneously — use that.

Use per-device disable for permanent exceptions, not policy changes. If one device generates noise for a monitor that's valid everywhere else, disable that specific monitor on that device from Dispositivo Detalles → Monitores. Don't weaken the policy for everyone else. For temporary suppression during planned work, use Maintenance Mode instead.