Skip to main content

Alert Filters

Learn how to use the filters and search on the Alerts page to find specific alerts.

The search box (Search alerts, policies, actors) does a plain-text substring match across each alert's name, policy, actor, severity, and status. Type any text and the list narrows to alerts whose fields contain it.

There is no query language, field-search syntax (key:value), or boolean operators — searching is a straightforward substring match.

note

Severity is matched on its raw value and status on its displayed label, so critical matches but in_progress does not — search In Progress instead.

Filter Chips​

Toggle one or more filter chips to narrow the list. Chips are multi-select, and the severity and status groups are combined with AND.

By Severity​

  • Critical & High — highest priority (grouped into one chip)
  • Medium
  • Low

By Status​

  • Open — new, not yet handled
  • Assigned to me — alerts assigned to you
  • In Progress — being worked
  • Resolved — addressed and closed

Selecting no chips in a group shows all values for that group.

note

There is no Muted chip and no Info-severity chip — reach muted alerts and info-severity records via search or by scanning the list.

Date Range​

Use the date-range selector to limit alerts to a time window. Options are Last 24 hours, Last 7 days (the default), Last 30 days, Last 90 days (requires Professional), and Last 1 year (requires Enterprise); options above your plan appear locked. The list respects the selected range together with your search text and filter chips.

Grouping​

Duplicate alerts for the same request are grouped by default, collapsing into one row with a "+N related" indicator and an expand chevron. Groups are formed either by shared request or within a short time window. Toggle Grouped off to see every alert as its own row.

Sorting​

Click a sortable column header to sort the list; click again to reverse the direction. Sortable columns are Severity, Status, Alert, Policy, Actor / Surface, and Last seen.

Sharing a View via URL​

The Alerts page reads a clientId query parameter, so you can link directly to alerts for a specific user:

https://app.containment.ai/dashboard/alerts?clientId=<client-id>

clientId is the only query parameter the page reads. Other filter state (search text, chips, date range, grouping) is applied in-page and is not encoded in the URL, so a link cannot pre-set a status or severity filter.