Working with alerts and menu customization

Actions for alerts can be accessed through the alert context menu, which is opened by right-clicking an alert.

Note: Actions for alerts can be accessed through the alert context menu, which is opened by right-clicking an alert. If the ENABLE_SHARED_ALERT_CONTEXT_MENU feature flag is enabled, all users will see the same menu format (structure and submenus). If the flag is not enabled, each user will see their own personalized menu structure. The ENABLE_SHARED_ALERT_CONTEXT_MENU feature flag is configured by an administrator by using a ConfigMap. For more details, see Configuring feature flags by using ConfigMaps.

For viewing detailed alert property data, including search, copy, and export capabilities, see Alert details.

Click the navigation icon at the upper-left corner of the screen to go to the main navigation menu.
In the main navigation menu, click Operate > Alerts.
Right-click any alert (or multiple alerts) in the Alert Viewer to open the shared alert context menu, and select from the following actions:

Acknowledge

Acknowledge an alert when you want to work on that alert. The acknowledged status is recorded as true in the Alert details.
De-acknowledge

De-acknowledge an alert if you are no longer working on it. The acknowledged status is recorded as false in the Alert details.
Update severity

Select from the following alert severities:
- Indeterminate
- Informational
- Warning
- Minor
- Major
- Critical
Suppress

When an alert is suppressed in Concert Operate, the alert.suppressed flag is set to true. The alert can still be viewed in the Alert Viewer, but the alert is filtered out of the view by default.
De-suppress

Changes the alert.suppressed flag from true to false. The alert is not filtered out of the view by default.
Take ownership

Take ownership of an alert if you want to work on resolving that alert.
Assign owner

Use this command to assign an alert to another user. That user then becomes the alert owner. You must select a user group the owner belongs to.
Assign user group

Use this command to assign an alert to a group.
Clear

Change the alert state to Clear.
Copy

Copies alert data to the clipboard. You can copy alert details either from the alert right‑click menu or from within the Alert details side panel using the Tabular or Raw view.
Quick Filter

Use quick filters to display alerts that match selected criteria. For more information, see Creating quick filters.

Alert actions

Menu customization

You can personalize the arrangement of right-click menu items. The arrangement is visible only to the user customizing the menu. You can customize your personal right-click menu unless an administrator has applied global menu controls.

Note: Administrators can define global settings for the alert right-click menu. These settings override user-level menu customization. As a result, some menu items might be hidden, fixed in position, or unavailable for personalization.

Users can control the following settings:

Menu items are hidden or visible
The order of menu items within the menu
Grouping menu items with dividers

To access menu configuration in the Alert Viewer, click User preferences > Configure alerts contextual menu.

The menu configuration page represents the layout of the menu. From here, you can click and drag menu items to re-arrange the order. You can use the options menu to hide or show menu items, and group menu items with dividers.

If a user has access to shared menu items, initially these items are shown as disabled in the menu configuration page. To enable shared menu items, select Show in menu from the options menu.

Note: If the ENABLE_SHARED_ALERT_CONTEXT_MENU feature flag is enabled, all users will see the same menu format (structure and submenus). If the flag is not enabled, each user will see their own personalized menu structure. The ENABLE_SHARED_ALERT_CONTEXT_MENU feature flag is configured by an administrator by using a ConfigMap. For more details, see Configuring feature flags by using ConfigMaps.

Action visibility and authorization

Action visibility in the shared alert context menu is evaluated per alert and per action based on administrator-defined authorisation rules.

An action is shown only if the user is authorized to run that action on the selected alert. Only actions that meet the defined authorization conditions appear in the menu. This behavior ensures that users see only the actions that are applicable to them.

Administrators define action visibility conditions by using the following tokens:

In the conditions, use $username with the owner property to control visibility based on the alert owner.
Use $usergroup with the team property to control visibility based on the assigned alert user group.
Use $userrole only when the visibility condition is based on a custom parameter that maps to the user role.

When multiple alerts are selected, an action is available only if the user is authorized to run that action on all selected alerts.

Add menu items

To add custom menu items for use in your personal menu, or to share with everyone, click Add menu item + from the menu configuration page.

Configure the following properties for a custom menu item:

Details
- Display name
- Description
- Select who can use this menu item (Only me or Everyone).
Figure 2. Add menu item - Details
Action definition and parameter-mapping that includes the following options:
- Choose from alert: based on the selected alert(s), set the desired properties as the action parameter value. If you want to minimize the scope to a singular key within the alert's details, enter a string value that matches a key from an alert's details. For example, if you enter "field1" in the Property field, it is understood as "alert.details.field1". Note: The permitted characters for the "details" field are A to Z, a to z, 0-9, and the underscore symbol (_). You can also use the alert.xxx template syntax to pass alert information directly to the action as input parameters. This allows you to pass specific alert fields or full alert data without making an additional API call.
  For example, you can reference alert fields in action parameters by using curly-brace templates:
  - {{alert.summary}}
  - {{alert.severity}}
  - {{alert.resource.name}}
  These templates are resolved at runtime when the action is triggered from an alert.
- Static value: set a fixed value for a parameter.
- Default value: use the default value specified in the Automation action definition.
- Choose at run time: input the value at the time the menu item is run.
  For more information about alert fields and structures, see Alert details.
Figure 3. Add menu item - Action

Figure 4. Add menu item - Map action parameters

Note: The availability of alert fields for parameter mapping depends on administrator-defined global settings and user permissions.
Conditions to define when a menu item should show on an alert right-click action:
- Columns: select specific columns for which the menu item will surface.
- Property: select from alert attributes that are predefined for Concert Operate and common to most alerts. If you want to minimize the scope to a singular key within the alert's details, enter a string value that matches a key from an alert's details. For example, if you enter "field1" in the Property field, it is understood as "alert.details.field1". Then, enter the string value in the Value field. Note: The permitted characters for the "details" field are A to Z, a to z, 0-9, and the underscore symbol (_).
- Operator: select a comparison operator from this list. The range of comparisons available is determined by your selection in the Property field.
- Value: the fields (or free-form string value) that appear here are dependent on the options selected in the Property and Operator lists.
Figure 5. Add menu item - Conditions
Additional configurations to define the alert activity entry. This is the message that will appear in an alert's activity once this menu item has been selected to act on the alert. To change the default entry, edit the message and preview the output.

Figure 6. Add menu item - Additional configurations

Implementation

The actions that are associated with custom menu items are implemented as Automation Actions.

Actions are one of the following types:

HTTP
SSH
Client-side

One benefit of using the Automation action framework for implementation is that these actions can be used independently of the right-click menu, either stand-alone or within a runbook. For more information, see Managing actions.

Menu item execution

Upon clicking a menu item, the actions will run in the background for each selected alert if there are no parameter mappings specified as Choose at run time. When all actions are completed, a notification is displayed with results for each selected alert.

Click the More information link in the notification to show the raw output from the action execution, which can be copied with the copy icon Copy .

An audit of all action executions is available on the Automations > Actions > Activities page.

If a menu item has a parameter mapping specified as Choose at run time, the user is directed to the Run action page to complete the parameter input and run the action when clicking a menu item.

In this scenario, when multiple alerts are selected the alert properties are combined into a comma-delimited list. The automation action can then process this list as required.

For menu items using an action of type Client-side, if there are no parameter mappings of Choose at run time, the parameter values are mapped to URL query parameters and a new browser tab opens with the resolved URL when running the menu item. These menu items are differentiated by the "launch" icon. Note, menu items of this type only work for single alerts. If multiple alerts are selected, properties of the context menu alert are used to resolve parameter mappings.

Access control

Access control applies at the menu item level and at both user and administrator scope. Administrator-defined global menu settings override user-level access where applicable. The menu items available for a user's personal menu consist of items the user has authored themselves, or items set with "Everyone" access. Preset menu items are read-only for everyone. Custom menu items can be updated by anyone with access to the menu item.