Alert Rules

Last updated on July 22, 2026

A rule decides which alerts your team receives and how. An alert appears when any rule's condition is met. Rules live at Alerts › Configure, or /{org}/~/alerts/configure.

You do not need a rule to start. The default rule already monitors every standard type with automatic detection.

Rule anatomy

FieldPurpose
NameFree text. Prefilled with the first free New Rule.
Alert typeExactly one type per rule. Create another rule to watch another type.
Trigger criteriaAutomatic, or fixed thresholds per severity.
FiltersMinimum severity, plus procedures, stations, and parts.
NotificationsThe Enabled switch and the Email severity floor.

A custom rule watches one alert type. This keeps criteria and scope unambiguous: a rule's thresholds always refer to one metric. The default rule is the exception, and it spans the whole catalog with automatic criteria.

Trigger criteria

Each type card carries an Automatic / Custom toggle.

  • Automatic self-calibrates severity from the metric's own baseline. See Automatic detection.
  • Custom gives you three severity lines. Each has a checkbox, a threshold, and its unit.

Run failed shows Custom only, because it has no automatic mode.

Severity lines

An unchecked line never fires: no alert, no email. This is why custom rules have no separate severity filter — the checked lines are the severity selection.

Thresholds must be ordered by severity: critical must trip at a value at or above warning, which must be at or above info. For Cpk floor the order inverts, since a lower Cpk is worse.

The form will tell you when a rule cannot do what you seem to expect:

  • This rule can never fire critical alerts — its highest enabled severity is warning.
  • Email starts at critical but this rule's criteria never fire above warning — it will never send email.

Windows

Yield drop and measurement drift take a window: the recent period compared against the preceding window.

SettingValue
UnitsDays, weeks, months
Default1 week
Range1 day to 90 days

A month is a fixed 30 days, not a calendar month, so windows stay deterministic.

Event types take no window. Their thresholds count consecutive runs or lifetime runs on a unit, not time.

Data floors

Custom criteria will not grade thin data.

TypeMinimum
Yield drop10 runs in the window, 100 in the baseline
Measurement drift10 recent and 30 baseline samples. Cpk metrics need 30 on both sides.

Filters

An empty filter applies to everything. Select entries to narrow the rule down, for instance to leave out a sandbox station or a dummy procedure.

Minimum severity

On automatic criteria, a rule routes a severity floor rather than a checkbox subset.

OptionRoutes
Critical onlyIncidents needing immediate attention.
Warning and aboveQuality regressions and incidents.
Info and aboveEverything this rule fires.

A floor rather than checkboxes means you cannot build a rule that routes info and critical but skips warning, which is never what anyone means.

Scope

The procedure, station, and part pickers facet each other: choosing procedures narrows the stations and parts on offer. Impossible combinations are flagged but not blocked, for example None of the selected stations run any of the selected procedures. You can still save; the rule may simply never match.

For yield drop and measurement drift, scoping by station (or by part, for yield) does more than filter: the rule grades that slice of the data against the slice's own baseline, instead of the pooled procedure-wide one. Measurement drift already separates parts by default. See the scope table.

Notifications

Enabled is the master switch. Off, the rule shows and delivers nothing anywhere.

Email is a severity floor, independent of what appears on the Alerts page.

OptionSends
OffNothing. Alerts stay on the Alerts page only.
Critical onlyCritical.
Warning and aboveWarning and critical. Info stays on the page.
All severitiesEvery alert, including info.

Two rules govern email:

  • The Alerts page always shows every severity the rule fires. Email is the interruption channel, not the record.
  • One email per severity level per episode. A days-long alert never re-notifies. If it escalates, the higher level sends once, threaded under the original message.

Recipients

Email goes to the organization owners. Members who leave the organization stop receiving alert email immediately.

Editing, deleting, restoring

What happens to alerts already open depends on the change.

ActionEffect on open alerts
Criteria editedNothing is resolved. Each alert gets a timeline note, and trend alerts are re-graded within a minute under the new criteria. Stricter criteria escalate in place; relaxed criteria close the episode and reopen it at the lower severity.
Rule disabledAlerts no other live rule fires are resolved, noted Rule "X" disabled by your name. Re-enable and they re-fire within a minute if still breaching.
Rule deletedSame as disabled, noted deleted by your name.

Event types cannot be re-graded without a new run, since their verdict comes from a run outcome rather than a metric. Editing criteria leaves their alerts untouched until the next run arrives.

Deleting is reversible. Deleted rules stop matching immediately and move to Recently deleted at the bottom of the rules list, with a live countdown, for 30 days. Restore brings back the same rule with its criteria intact. After 30 days it is permanently deleted.

How is this guide?

On this page