Introduction
Get alerted when a device goes offline — or comes back online. The Connection monitor watches device reachability and fires an alert when the status you're tracking is breached for longer than your defined threshold.
It's the baseline monitor for any environment. If a device drops off and nobody notices, everything downstream breaks silently.
Moniteur de connexion
The Connection monitor checks whether devices covered by the policy are online or offline. When the condition you've configured is met — and stays met for the full breach duration — Level creates an alert.
Two conditions are available:
Appareil goes offline — alert when a device stops reporting to Level
Appareil comes online — alert when a device returns to an online state (useful for tracking unexpected reboots or unauthorized power-ons)
Configuring Moniteur de connexion
Open the monitor policy you want to add this to, then click + Ajouter new monitor (or open an existing Connection monitor to edit it). The Modifier monitor panel opens on the right.
Nom and Tapez
Entrer a name in the Nom field. Be specific — something like "Servers - Offline Detection" is more useful than "Moniteur de connexion" when you're scanning a list of alerts.
Set Tapez to Connection.
Gravité
Set Gravité to match how your team should respond to this alert. Four levels are available:
Information — low priority, FYI-level
Warning — worth attention but not urgent
Critical — requires prompt response
Emergency — drop everything
💡 CONSEIL : For server offline alerts, Critical or Emergency is usually appropriate. For workstations, Warning is often enough — a workstation going offline overnight is normal.
Connection Statut
Set Connection status to the condition you want to monitor:
Appareil goes offline — triggers when a device stops reporting
Appareil comes online — triggers when a device reconnects
Breach Durée
Breach duration controls how long the condition must be true before Level creates an alert. Set it using the slider or the up/down arrows — both adjust the same value. The range is 0 to 120 minutes.
Setting breach duration to 0 fires the alert immediately when the condition is detected. A small buffer (1–5 minutes) cuts down on noise from brief connection blips without meaningfully delaying real alerts.
💡 CONSEIL : A 2–5 minute breach duration works well for most offline alerts. Appareils occasionally lose connectivity momentarily during updates, network switches, or agent restarts — a short buffer filters those out without meaningful delay on genuine incidents.
Auto-Résoudre
The Résolution automatique alert if it is no longer applicable toggle (enabled by default) automatically closes the alert when the condition clears — meaning the device comes back online (for an offline alert) or goes offline again (for a come-online alert).
Leave this on unless you want alerts to persist for manual review regardless of current state.
Remediation
Optionnelly attach one or more automations to run automatically when this monitor fires. This is how you trigger a pager, create a ticket, or kick off a recovery script the moment an alert is created.
Cliquez sur in the Remediation field and select an automation from the list.
To add more, click + Ajouter another remediation.
To remove one, click the × next to it.
Once an automation is attached, open it from the link icon and assign the monitor's payload to an automation variable if you want to pass alert data (device name, timestamp, condition) into the automation's logic.
ℹ️ REMARQUE : Remediations run when the alert is created, not when it resolves.
Nontifications
Two notification toggles control whether policy recipients get emailed:
Send notifications on alert creation — recipients get an email when the alert fires
Send notifications on alert resolution — recipients get an email when the alert auto-resolves or is manually resolved
Recipients are configured at the monitor policy level, not per individual monitor. Go to the Recipients section of the policy to add email addresses.
ℹ️ REMARQUE : If no recipients are added to the policy, notification emails won't send regardless of these toggle states.
Saving the Moniteur
Cliquez sur Update monitor to save changes to an existing monitor, or Ajouter monitor if you're adding a new one. The monitor list in the policy updates immediately.
Questions fréquemment posées
Who can create and edit monitors? Technicians with access to the relevant monitor policy can create and edit monitors. Policy-level access is controlled by your organization's permission settings. See Workspace → Autorisations for details.
Why didn't my alert fire even though a device went offline? Check your breach duration setting. If the device came back online before the breach duration elapsed, no alert will be created. Also confirm the device is covered by the policy's target tags.
Can I use the Connection monitor to detect unexpected reboots? Oui — set Connection status to Appareil comes online and attach a remediation automation that logs or notifies. A device that reboots unexpectedly will briefly appear offline, then come back online and trigger this monitor.
What's the difference between "Appareil goes offline" and the device status in the Appareil Listing? The device listing shows current status in real time. The Connection monitor creates a persistent alert when offline status is sustained beyond your breach duration. The listing will show the device as offline immediately; the alert appears only after the threshold is met.
Can I attach the same automation to multiple Connection monitors? Oui. Automatisations can be used as remediations across as many monitors as needed. If you're passing monitor payload data into the automation, the payload will reflect whichever monitor triggered it.
What happens to open Connection alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close or remove alerts it already created — you'll need to resolve those manually.