Alert Details

This article describes the Alert Details page in the Kentik portal.

Alert Details Page

The Alert Details page provides a comprehensive, full-screen environment for investigating a specific alert generated by your network policies.

While the main Alerting page offers a high-level view for triaging active and historical events, the Alert Details page allows you to dig into the granular metrics, threshold conditions, and traffic visualizations for a single event to determine exactly why it triggered and how to resolve it.

Note: The layout and available data on this page will vary slightly depending on whether you are investigating a standard threshold alert, a Protect (DDoS) alert, or an NMS alert.

Alert Details Page Access

Access the Alert Details page for an individual alert from the following locations:

Alerts List: Either:
- Click the alert’s ID in the Alert ID column or;
- Click the vertical dots icon at the right and choose View Alert Details.
Alert Summary Drawer (via the Alerting Page or DDoS Defense Page): Either:
- Click the ID under Alert Overview or;
- Click View Details under Take Action.
DDoS Defense Page (alert type: Protect only): In the “Attacks Active Within the Last 24 Hours” table:
- Click the alert’s ID in the Alert ID column, or;
- Click the vertical dots icon at the right and choose View Details.

Note: Depending on your browser settings, Details pages may open in a new tab or window.

Alert Details Subnav

The subnav of an alert’s Details page includes the following elements:

Breadcrumbs: Indicates your current location within the Kentik portal. Click Alerting to return to the Alerting page.
Share: Opens the Share dialog (see Sharing via the Share Dialog).
Actions: Choose Export from the dropdown to download a visual report (PDF) of the page’s visualizations and tables. A notification appears when the PDF is ready to download.

Alert Details Main Display

The main display area of the Details page for a threshold policy alert has several panes that provide actionable details.

Title Pane

The Title (top-most) pane contains the following information:

Alert name: The alert name, as defined in its policy.
Description: A brief summary of the situation this alert policy addresses.

Top Metrics Row

Below the title, a row of metrics illustrates the exact situation that generated the alert. The columns vary based on the policy:

Alert State: The current state (e.g., ACTIVE or CLEARED) and the duration it has been in that state.
[Dimensions]: Dynamically named based on the policy’s key (e.g., Dest IP/CIDR), showing the specific infrastructure or traffic source involved.
Primary Metric: The actual value of the main tracked metric (e.g., 79.33 Kpackets/s) and the percentage by which it exceeded the threshold.
Secondary Metric (if applicable): The value of any secondary metrics configured in the policy conditions (e.g., Unique Src IPs).
Note: Comparison of the actual value to the triggering value is defined in the alert policy. For example, if policy threshold condition is "flows/s value is greater than 200% of baseline" then the statistics will include not only the actual flow/s but also the percent difference to the baseline flows/s.

Threshold Data Pane

The Data pane shows charts and tables for the condition that caused the alert. Its structure depends on the type of alert:

Cloud and traffic alerts: Includes a time series chart of the traffic that caused the alert (displays metrics selected in the policy).
Protect alerts: Six tabs displaying charts and tables showing different aspects of the traffic covered by the alert (see Protect Data Tabs).

For all alerts, the following elements are present:

View in Data Explorer: A link below each chart to Data Explorer, with the alert’s key pre-populated in the Query sidebar.
Why Was This Triggered?: A detailed table breaking down exactly how the traffic violated the policy. It displays the Type (Static or Baseline), the required Policy Conditions (e.g., ≥ 50 Kpackets/s), and the actual Triggering Value, along with the mathematical difference between the two.
Note: For Protect alerts, this appears on the Insights tab.
History: A table detailing recent or active alerts with matching dimensions. Click the ID column link to go to the alert’s Details page or click Ack Alert to open the Acknowledge Alert Dialog.

Protect Data Tabs

The Data pane on a Protect (DDoS) alert’s Details page displays tabs with different visualizations.

The following tabs are included in the Data pane for a Protect alert:

Alert: A time series chart showing the traffic that triggered the alert (based on volume metrics defined in the policy). Below, it details the trigger conditions and state changes.
Ingress Interfaces: A chart showing traffic volume for the affected interfaces, along with device and site details.
Traffic Patterns: A chart and table characterizing traffic volumes, sources, services, and directionality.
Source Countries: A chart showing unique source IPs of the attack traffic, and a table ranking the corresponding countries.
Source Services: A chart showing originating services for the traffic and a table ranking them.
Packet Size Distribution: A bar chart showing packet sizes, and a table ranking them by traffic volume.

Note: The charts start 30 minutes before the alert's start time and end with the current time (if active) or its end time.

The right sidebar of an alert’s Details page provides additional details. Sidebar of Alert Details page showing a critical alert with details on severity and actions taken.

Ack statement (if the alert’s been acknowledged): Displays who acked the alert and when. If a comment was added, it’ll display here and in the Comments Pane.
Alert Overview: Key information about the alert (see Details Page Alert Overview).
Mitigation Details: Info about the mitigation automatically triggered by this alert, if defined by the alert policy (see Mitigation Details).
Policy: Information about the alert policy:
- Edit Policy: Links to the Edit Policy page for the alert (see Policy Settings Pages).
- Name: The policy name that triggered the alert (see Alert Policies).
- Last Edited: How long ago the policy was edited.
- Alerts for Policy: The number of alerts generated from this policy in the last 7 days.
Comments: A field to view and add comments (see Comments Pane).
Take Action: Buttons for additional alert-specific actions (see Alert-Specific Actions).
Warning: If the policy’s changed since the alert started, a warning appears in the affected sidebar sections.

Notes:
Sidebar info can vary between Protect and non-Protect alerts.
For NMS alerts, see NMS Alert Details Sidebar.

Details Page Alert Overview

The Alert Overview section in the Details page sidebar includes:

Copy Alert ID: Copies the alert’s ID to your clipboard.
ID: The unique alert ID.
Severity: The alert’s severity level (Critical, Severe, Major, Warning, or Minor). Severity is determined by the alert policy threshold that triggered the alert.
Alert State: The alert’s state: Active (red) or Cleared (green). See Alert State.
Ack State: The alert’s acknowledgement state (Ack Required, Acked, or Not Acked). See Ack State.
Start Time: The start of the period evaluated for the alert.
Event End Time: The end of the period evaluated for the alert, calculated based on the counter reset time from the threshold policy settings. Only present when the alert is cleared.
Clear Time: The end of the period evaluated for the alert. Displays “Currently Active” if the alert is ongoing.
Clear Reason: Explains why the alert ended (e.g., "Alert clearing conditions were met"). Only visible if the Alert State is Cleared.

NMS Alert Details Page

Access the NMS Alert Details page as described in Alert Details Page Access. While similar to a typical Alert Details Page, there are some differences.

NMS Alert Details Display

The main display area is divided into a set of panes, as described in Alert Details Main Display. Below, we’ll cover the contents of those panes for an NMS alert.

NMS Statistics Pane

The fields across the top of the page provide NMS-specific statistics, including the measurement, metric, and dimensions specified on the policy that generated the alert.

NMS Data Pane

The Data pane shows charts and tables related to the condition that caused the alert, varying by alert type as follows:

NMS Up/Down: Includes an up/down chart that details the alert status over time (see Up/Down Visualization).
NMS Threshold: Includes a line chart detailing the alert’s activity over the time specified in the Lookback dropdown at top right.

The View in Metrics Explorer link above the chart takes you to Metrics Explorer, where the alert policy settings are pre-populated in the Query sidebar. The pane also includes a History table, which details recently-triggered or currently active alerts.

Up/Down Visualization

This time-based chart type displays a series of bars on a horizontal time axis, each representing a segment of the current time range. The color of each bar indicates the state of the policy’s data sources (devices, interfaces, or BGP neighbors) at that point: green = up, red = down, and gray = unknown. Hover over any bar to open a popup displaying the timestamp and state during that segment.

Up/Down visualizations have a Lookback dropdown for choosing the timeframe covered:

NMS Details drawer: Last hour, Last day, Last 7 days, Last 14 days, and Last 30 days.
NMS Details page: Alert +/- 1 hour, Alert +/- 24 hours, Last hour, Last day, Last 7 days, Last 14 days, and Last 30 days.

In the NMS Details drawer, if an event occurred during a segment, its bar will be slightly elevated an icon will appear above it:

Red Bell: An alert was triggered.
Green Checkmark: The alert was cleared (according to policy settings).

The right sidebar on the Details page for an NMS alert provides different details than for non-NMS alerts. It includes:

Alert Overview: Information about the alert (see Details Page Alert Overview).
Device: The device being alerted on (if applicable), with various device details including site, model, location, IP address, manufacturer, and serial number.
- View Details: Link to the NMS Device Details Page for that device.
Policy: Info about the alert policy:
- Edit Policy: Links to the alert’s Edit Policy page (see Policy Settings Pages).
- Name: The policy name that triggered the alert (see Alert Policies).
- Last Edited: How long ago the policy was edited.
- Alerts for Policy: The number of alerts generated from this policy in the last 7 days.
Take Action: Buttons for additional alert-related actions (see Alert-Specific Actions).
Comments: A field to view and add comments (see Comments Pane).
Warning: If the policy’s changed since the alert started, a warning appears in the affected sidebar sections.

Documentation Index