Skip to main content

Managing Alerts

Learn how to manage, investigate, and resolve alerts in Containment.AI.

Alert List View​

The Alerts page shows the alerts in your organization. Columns are Severity, Status, Outcome, Assigned to, Alert, Policy, Actor / Surface, and Last seen, plus a per-row action menu. Outcome values are Blocked, Allowed with alert, and Redacted.

  • Sortable columns — click a header to sort
  • A queue counter above the list reads "N open · N in progress · N resolved · N muted"
  • Click a row to open its detail drawer
  • Duplicate alerts for the same request are grouped by default, shown as "+N related" with an expand chevron; toggle grouping off to see every row
  • Paginated at 50 alerts per page

Viewing alerts requires the alert-viewer permission. With view access but not manage access, the page is read-only and action controls are hidden.

Alert Statuses​

An alert is always in one of four statuses:

StatusMeaning
OpenNew, not yet handled
In ProgressBeing worked
ResolvedAddressed and closed
MutedSuppressed from the active view

Investigating Alerts​

Viewing Alert Details​

Click any alert to open the detail drawer:

  1. Header - Severity, status, and outcome badges, the summary, and a copyable Alert ID
  2. Metadata - Guardrail, enforcement outcome, actor/machine, source IP, last seen, and a severity score explanation
  3. Request snapshot - Endpoint, sensitive fields, redacted prompt excerpt, model response snapshot
  4. Response actions - Acknowledge, resolve, triage status, assign, create exception

Understanding the Match​

The request snapshot shows the retained alert metadata:

  • Sensitive fields - The matched terms or patterns that triggered the policy
  • Guardrail - Which policy matched
  • Summary - Description of what was flagged
note

The policy-check service retains only violation alert metadata (policy name, severity, violation message, and the matched term/pattern). The full prompt text is not stored.

Gathering Context​

Before taking action, consider:

  • Is this a known false positive pattern?
  • What was the user trying to accomplish?
  • Is this a repeat offense?
  • What's the business context?

Taking Action​

From the alert detail drawer:

Acknowledge​

Record that you've seen the alert. Click Acknowledge alert; the drawer then shows who acknowledged it and when, so other admins can see it's been picked up.

Acknowledging does not change the triage status — use the status control for that.

Mark as Resolved​

Click Mark as resolved to close the alert once it's addressed.

Change Status​

Use the Triage status control to move an alert between Open, In Progress, Resolved, and Muted. Mute an alert to suppress it from the active view.

Assign​

Use Assign to hand the alert to an organization member. Assigning also moves the alert to In Progress.

Bulk Actions​

Select rows to reveal a bulk toolbar with Clear, Acknowledge, Assign to me, Mute, and Resolve.

Creating an Exception​

If a match is a legitimate false positive, create an exception from the alert (exception workflows require a plan that includes them):

  1. On the Alerts list, open the alert row's action menu (the ⋯ menu) — or open the detail drawer.
  2. Choose Create exception.
  3. Complete the exception details and save.

See Exceptions for the full exception model, including the caveat that exceptions cannot yet be listed or revoked in-product.

caution

Exceptions should be rare and well-documented. Consider adjusting the policy instead of granting many exceptions.

Triage Guidance​

Efficient Triage​

  1. Start with Critical/High severity.
  2. Use the alert filters to narrow the list.
  3. Resolve or mute handled alerts so the active view reflects outstanding work.
  4. Add context in your own tracking as you go.

Reducing Volume​

If alert volume is too high:

  • Review the triggering policies' keywords and patterns
  • Grant narrow, time-limited exceptions for legitimate matches
  • Consider policy restructuring
  • Train users on acceptable use
  • Leave alert grouping on so duplicate alerts for one request collapse into a single row

Suggested Response Times​

  • Critical: Immediately
  • High: Within 4 hours
  • Medium: Within 1 business day
  • Low: Weekly review