---
title: "Alerting"
slug: "alerting"
description: "Explore Kentik's Alerting systems that analyze network traffic, detect anomalies, and ensure optimal performance and availability."
updated: 2026-07-17T15:15:30Z
published: 2026-07-17T15:15:30Z
canonical: "kb.kentik.com/alerting"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerting

This article discusses Kentik’s Alerting systems, which analyze your network traffic and detect anomalous patterns that might represent threats to availability or performance.

![Overview of active alerts with severity levels and metrics in the alerting dashboard.](https://cdn.us.document360.io/082e25b5-afce-42d4-8f47-70bd3f1d02b7/Images/Documentation/AL-alerting-page-main(1).png)

*Triggered based on policy settings, alerts provide details on anomalous network activity or state.*

Kentik’s Alerting systems include both the main policy-based alerting system, which is the focus of this set of articles, and a synthetics-specific alerting system:

- **Policy-Based Alerting:** Uses policies of various [**types**](/v1/docs/alerting-4#policy-types) to define conditions for alerting:
  - Policies are managed with the portal’s [**Alert Policies**](/v1/docs/alert-policies-2#alert-policies-page-ui) settings page, accessed via **Settings »** **Alert Policies** in the portal’s main nav menu.
  - Includes thresholds for triggering an alarm and actions ([**notifications**](/v1/docs/notification-channel) and/or [**mitigations**](/v1/docs/mitigation-overview)) when “alarm state” is entered.
  - View and manage policy-based alerts on the [**Alerting Page**](/v1/docs/alerting-page), accessed via the portal’s main nav menu.
- **Synthetics Alerting**: Kentik’s [**Synthetics**](/v1/docs/synthetics-overview#about-synthetics) testing includes an alerting system that generates alerts based on test results:
  - Set thresholds for a tested entity’s health status on the Health tab of the **Tests** page when adding or editing a test (see [**Health Settings Tab**](/v1/docs/test-settings-reference#health-settings)).
  - Specify alert conditions on the [**Alerting and Notifications**](/v1/docs/test-settings-reference#alerting-and-notifications) tab.

## Policy Types

When a policy is created, either by a Kentik user or automatically via [**Alert Policy Templates**](/v1/docs/alert-policy-templates), it is categorized into one of two primary architectures: **Flow** or **NMS** policy types.

The policy type dictates what data is evaluated, how it triggers, and where the resulting alerts appears in the portal. All policies are managed (added, cloned, edited) via the **Settings »** **Alert Policies** page in the Kentik portal.

### Flow Policies

[**Flow policies**](/v1/docs/flow-policy-settings) (Protect and Traffic) use comparative evaluations to monitor network traffic data, such as NetFlow or VPC flow logs. When the current traffic matches the conditions defined in your policy thresholds, it triggers an alert (entering an ALARM state) and can initiate automated actions like [**notifications**](/v1/docs/notification-channel) and DDoS [**mitigations**](/v1/docs/mitigation-overview).

| Policy Type | Description | Where Created | Appears on DDoS Defense Page? |
| --- | --- | --- | --- |
| **Protect** | Detects traffic patterns indicating potential attacks (e.g., SYN floods, amplified reflections). | [**Add Alert Policy**](/v1/docs/alert-policies-2#add-a-flow-policy) page | Yes |
| **Traffic** | Detects standard traffic patterns, flow rate thresholds, and fluctuations. | [**Add Alert Policy**](/v1/docs/alert-policies-2#add-a-flow-policy) page, [**Data Explorer**](/v1/docs/data-explorer) | No |

### NMS Policies

[**NMS (Network Monitoring System) policies**](/v1/docs/nms-policy-settings) are metrics-based and built on [**Kentik NMS**](/v1/docs/nms-overview). They evaluate performance data to alert you when a monitored entity, such as a device, interface, or BGP neighbor, becomes unhealthy or drops below a specific baseline.

> [!NOTE]
> **Note**: All NMS policies are created on the [**Add Alert Policy**](/v1/docs/alert-policies-2#add-an-nms-policy) page and only appear on the main [**Alert Policies**](/v1/docs/alert-policies-2#policies-list) list, never on the DDoS Defense page.

| Policy Type | Description |
| --- | --- |
| **Agent** | Agent health (e.g., resource usage, status). |
| **Agent Capability** | Capability health (e.g., enablement, status). |
| **BGP Neighbor** | BGP peering session states and metrics (e.g., session state changes, advertised prefixes). |
| **Component** | Device component states and metrics (e.g., CPU, power supply). |
| **Device** | System-level device states and metrics (e.g., up/down status, CPU/memory). |
| **Event** | SNMP traps or syslog messages filtered via regex. |
| **Interface** | Interface states and counter metrics (e.g., oper status, traffic spikes). |
| **Classic Threshold** | Rolling window aggregations and classic baselines (average-over-time thresholds). |
| **Custom** | Any NMS measurement, including cloud and custom metrics from integrations. |

> [!NOTE]
> **Note:** The filters on the [**Alert Policies**](/v1/docs/alert-policies-2) and [**Alert Policy Templates**](/v1/docs/alert-policy-templates#alert-policy-templates-page) pages determine which of these policy types appear in your active lists.