> For the complete documentation index, see [llms.txt](https://docs.pagerly.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pagerly.io/incidents-and-alerting/integrations/alert-rules.md).

# Alert Rules and Alerts Without Incidents

Ignore alerts you do not need, send alerts to different teams or escalations based on what is in them, and page people without opening an incident

By default an alert integration sends every alert to one team or escalation, and each alert opens an incident. The **Rules** tab on an alert integration lets you change both.

{% hint style="info" %}
An integration with no rules that opens incidents works exactly as it always has. Nothing here applies until you turn it on for that integration.
{% endhint %}

### Open the Rules tab

1. Go to **Alert Integrations** in the left sidebar.
2. Click the integration.
3. Open the **RULES** tab.

![](https://296040630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu15pukNExHWOsjYrdZrh%2Fuploads%2Fgit-blob-432bb14e90b0120414a6937dc080566a84d981b6%2Falert-rules-tab.png?alt=media)

### Choose what each alert opens

Under **Each alert opens**, pick one:

* **An incident** — The alert pages people and opens an incident. This is the default.
* **An alert** — The alert pages people only. It is acknowledged and resolved like an incident, and escalates the same way, but it has no incident channel, no postmortem and no ticket, and it is left out of the incident list and reports.

### See every alert

Open **Incidents & Alerts → Alerts** in the left sidebar. It lists everything your alert integrations sent that paged someone, with the source, where it was sent, and whether it opened an incident or was alert-only. Use the tabs to show only one kind, or search by alert or source.

![](https://296040630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu15pukNExHWOsjYrdZrh%2Fuploads%2Fgit-blob-2b636fbba965d513dbc1714797ead27cbd05640e%2Falerts-page.png?alt=media)

Click an alert to see its details and **timeline**: when it was received, each escalation and who was notified, when it was acknowledged, notes, and when it was resolved, with how long each step took. An alert-only record has **Turn into an incident** for when it turns out to need the full incident workflow.

![](https://296040630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu15pukNExHWOsjYrdZrh%2Fuploads%2Fgit-blob-7a2f684c6d9c1cff96ba81d23fdcfc631ec201f1%2Falert-timeline.png?alt=media)

Alert-only records do not appear in the Incidents list or in incident reports. Alerts ignored by a rule are not listed.

### Add rules

A rule looks at each new alert and either ignores it or sends it somewhere other than the integration's own team or escalation.

1. Click **Add rule**.
2. Under **When an alert**, add one or more conditions. Each condition checks:
   * **Severity**, **Title** or **Description** — the values from the integration's payload mapping, or
   * **Payload field** — any field of the alert payload, by its path (for example `tags.env` or `alerts.0.labels.team`).
3. Choose the comparison: **is**, **is not**, **contains** or **does not contain**. Comparisons ignore upper and lower case.
4. Under **Then**, choose what happens:
   * **Send to a team** — pages whoever is on call for that team.
   * **Send to an escalation** — pages that escalation's layers in order.
   * **Ignore it** — nothing opens and nobody is paged.
5. For a rule that sends the alert somewhere, **and open** lets that rule open an incident or an alert regardless of the integration's setting.
6. Click **Add rule**.

### How rules are applied

* Rules are checked from top to bottom. The **first rule that matches** decides. Use the arrows to reorder them.
* Every condition in a rule must hold for it to match.
* An alert that matches no rule goes to the integration's own team or escalation.
* Rules apply when an alert **first arrives**. Updates and the recovery for an alert that is already open go to the same place it was opened, even if you change the rules in the meantime.
* If a rule points at a team or escalation that has since been deleted, the alert goes to the integration's own team or escalation rather than being lost.
* An escalation that a rule sends alerts to cannot be deleted until the rule is changed.

### Examples

**Drop staging alerts**

* When: Payload field `tags` contains `env:staging`
* Then: Ignore it

**Send critical alerts to an escalation**

* When: Severity is `SEV 1`
* Then: Send to an escalation → *Critical*

**Page for everything, open incidents only for critical alerts**

* Each alert opens: **An alert**
* Rule — When: Severity is `SEV 1`. Then: Send to a team → *Platform*, and open **An incident**