Alert triage

Ask your agent to cluster similar open alerts, so duplicates collapse into one parent alert instead of filling the list.

When many alerts fire for the same underlying problem, your alert list becomes hard to read. Alert triage lets you ask your agent to group similar open alerts into clusters, so you can collapse the duplicates into one parent alert, hand a cluster to an investigation, or declare an incident for it.

Triage is about grouping, not root cause. It tells you these alerts belong together — it does not analyze why they fired. For that, use a root cause analysis.

AI SRE

Start a triage

Triage runs on request in a chat with the agent. There is no button and no automatic trigger.

1

Open a chat with your agent

2

@mention the agent and ask it to triage, for example:

• "triage my alerts"
• "cluster my open alerts"

You can add a time range in plain language, e.g. "triage my open alerts from the last 6 hours".

3

The agent fetches the matching alerts, groups them, and posts one card per cluster in the chat

What gets triaged

• Open alerts by default — alerts in PENDING and ACCEPTED state. Ask for other states explicitly if you need them.
• A time range if you give one, otherwise all matching open alerts.
• Only alerts you can see. Triage runs with your own visibility, so neither a team-scoped agent nor a user without access to a team ever sees that team's alerts.

If the request matches more than 100 alerts, the agent stops and asks you to either confirm triaging the 100 most recent ones or adjust the time range.

What you get back

One card per cluster, containing:

• A short caption naming what the cluster has in common, and a one-sentence description
• The number of alerts in the cluster — click it to open them
• The oldest and newest alert timestamps in the cluster
• The affected services, plus services the agent considers potentially affected
• The suggested parent alert for merging — the oldest alert in the cluster

Below the clusters you get a Distinct alerts card listing the alerts the agent deliberately did not group.

Actions on a cluster

Each card carries up to three buttons. They are independent — using one leaves the others available on the same card.

Action	What it does
Merge Alerts	Merges every other alert in the cluster into the suggested parent alert. The child alerts stop appearing separately in your alert list.
Investigate	Hands the cluster's alerts and services to a root cause investigation.
Declare Incident	Declares an operational incident titled from the cluster caption, with the cluster's description as the summary, all its alerts linked, and its affected services set to degraded. When the incident is created, the button turns into a link to it.

Buttons you cannot use are hidden rather than shown as failing: Investigate does not appear if investigations are unavailable for the agent, and Declare Incident requires your own permission to declare incidents.

Merge Alerts and Declare Incident change data in your account. Only the buttons on the card trigger them — the agent never merges alerts or declares incidents on its own.

Limits

• Up to 100 alerts per run without confirmation; on confirmation the 100 most recent matching alerts are triaged.
• A single Merge Alerts action can merge at most 40 child alerts into the parent, so a cluster of more than 41 alerts cannot be merged in one click.
• Results are kept for 24 hours. Running triage again over an overlapping window reuses the clusters it already established and tells you how many groups are new, instead of regrouping everything from scratch.