> ## Documentation Index > Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Alert details > Palo Alto Networks Cortex XCOR lists triggered alerts and generates detailed visualizations of each alert. export const AddToDashboardIcon = props => { return ; }; export const CollectionIcon = props => { const drawPath = "M21 6.5c-1.66 0-3 1.34-3 3 0 .07 0 .14.01.21l-2.03.68c-.64-1.21-1.82-2.09-3.22-2.32V5.91C14.04 5.57 15 4.4 15 3c0-1.66-1.34-3-3-3S9 1.34 9 3c0 1.4.96 2.57 2.25 2.91v2.16c-1.4.23-2.58 1.11-3.22 2.32l-2.04-.68C6 9.64 6 9.57 6 9.5c0-1.66-1.34-3-3-3s-3 1.34-3 3 1.34 3 3 3c1.06 0 1.98-.55 2.52-1.37l2.03.68c-.2 1.29.17 2.66 1.09 3.69l-1.41 1.77C6.85 17.09 6.44 17 6 17c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3c0-.68-.22-1.3-.6-1.8l1.41-1.77c1.36.76 3.02.75 4.37 0l1.41 1.77c-.37.5-.59 1.12-.59 1.8 0 1.66 1.34 3 3 3s3-1.34 3-3-1.34-3-3-3c-.44 0-.85.09-1.23.26l-1.41-1.77c.93-1.04 1.29-2.4 1.09-3.69l2.03-.68c.53.82 1.46 1.37 2.52 1.37 1.66 0 3-1.34 3-3S22.66 6.5 21 6.5zm-18 4c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zM6 21c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zm5-18c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1-1-.45-1-1zm1 12c-1.38 0-2.5-1.12-2.5-2.5S10.62 10 12 10s2.5 1.12 2.5 2.5S13.38 15 12 15zm6 4c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1zm3-8.5c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1z"; return ; }; export const CollectionNavIcon = props => { const drawPath = "M8.4 18.2C8.8 18.7 9 19.3 9 20C9 21.7 7.7 23 6 23S3 21.7 3 20 4.3 17 6 17C6.4 17 6.8 17.1 7.2 17.3L8.6 15.5C7.7 14.5 7.3 13.1 7.5 11.8L5.5 11.1C5 11.9 4.1 12.5 3 12.5C1.3 12.5 0 11.2 0 9.5S1.3 6.5 3 6.5 6 7.8 6 9.5V9.7L8 10.4C8.6 9.2 9.8 8.3 11.2 8.1V5.9C10 5.6 9 4.4 9 3C9 1.3 10.3 0 12 0S15 1.3 15 3C15 4.4 14 5.6 12.8 5.9V8.1C14.2 8.3 15.4 9.2 16 10.4L18 9.7V9.5C18 7.8 19.3 6.5 21 6.5S24 7.8 24 9.5 22.7 12.5 21 12.5C19.9 12.5 19 11.9 18.5 11.1L16.5 11.8C16.7 13.1 16.3 14.5 15.4 15.5L16.8 17.3C17.2 17.1 17.6 17 18 17C19.7 17 21 18.3 21 20S19.7 23 18 23 15 21.7 15 20C15 19.3 15.2 18.7 15.6 18.2L14.2 16.4C12.8 17.2 11.2 17.2 9.8 16.4L8.4 18.2Z"; return ; }; export const ServiceIcon = props => { return ; }; export const ServiceNavIcon = props => { return ; }; export const CSharpIcon = props => ; export const PipeIcon = props => ; export const AiMessageIcon = props => ; export const MicroscopeIcon = props => ; Palo Alto Networks Cortex XCOR lists all triggered alerts and their status, and generates detailed visualizations of each alert. The visualizations and related tools help you analyze when, why, and how an alert was triggered. Each alert instance is identified by the unique combination of series labels and static entity labels that remain after any signal grouping is applied. This means two triggered alerts are distinct instances when their label sets differ, even if they come from the same monitor. Each alert instance has a unique URL. Click **Copy URL** in the page header to copy a shareable URL to your clipboard. Share it with teammates so they can view the same page directly. The alert details page is mobile-responsive so you can view alert status, examine chart data, and [mute alerts](#mute-an-alert) from a mobile device. ## View the list of alerts To view the list of triggered alerts, select ** Alerting > Alerts** in the navigation menu. Each listed alert includes several columns of information: * The date and time that it was **Created at** * Its **Status**, designated with an icon, text, and color (see [Alert status](#alert-status)) * Its title (**Alert**), as a link to its alert details page * The duration that the alert has been **Alerting for** * The **Configuration entity** related to the alert, as a link to the associated entity, such as a [monitor](/investigate/alerts/monitors) or [SLO](/observe/slo) You can define the number of **Rows per page** to display by clicking its dropdown and selecting a value. To navigate between pages, click the **\< Go to previous page** and **> Go to next page** buttons. ### Alert status The alerts list and alert details page designate status with an icon, text, and color: | Icon | Text | Description | | - | - | - | | | **Critical** | Actively triggered alert that exceeds the defined critical conditions. | | | **Warning** | Actively triggered alert that exceeds the defined warning conditions. | | | **Muted** | Alert that's muted by an active muting rule. | | | **Resolved** | A resolved alert. | ## View an alert's details Access an alert's detail page from the alerts list or another reference to the triggered alert. References include the source [monitor](/investigate/alerts/monitors) or [service level objective (SLO)](/observe/slo) that defined the alert's triggers. ### Status and signals Each alert presents **alert details** in a dedicated section. This section includes the alert's status, a visualization of the triggering queries and change events, and a table of the series and conditions that triggered the alert. For status icon and label descriptions, see [Alert status](#alert-status). The page also lists any triggering **[Signal](/investigate/alerts/notifications/signals)** as chips that identify its keys and their values. ### Query tabs The alert details section provides two tabs for viewing query results: * **Stored data**: Default. Visualizes the alert's original query of currently stored metric data. Results typically match what the alerting engine evaluated, but can differ if late-arriving data has since been ingested. To account for ingestion delays, consider [adding an offset to your query](/investigate/alerts/troubleshooting#add-offsets-to-your-query). * **Evaluated data**: Queries the `ALERTS_VALUE` metric, which records the values the alerting engine computed at each evaluation interval. See [Alert metrics](/investigate/querying/metrics/alert-metrics) for reference documentation about the `ALERTS` metric and its labels. This view shows what the monitor actually saw when it made its alerting decision, regardless of data that arrived later. The table for this tab includes **alertstate** and **severity** columns. A series with `alertstate` set to `pending` triggers an alert after it has been continuously breaching the threshold for the sustain duration configured on the monitor. Use the **Evaluated data** tab to determine if the alerting engine observed data differently than what's currently stored, such as when late-arriving metrics change the stored view. Both tabs display query results as a [time series chart](/observe/dashboards/panels/time-series-chart). You can optionally: * Toggle **Show thresholds**, which draws dotted horizontal lines on the time series chart depicting the alert's triggering thresholds. * Toggle **Show query** or **Show queries**, which displays the active tab's underlying queries. * Click **Open in explorer** to open [Metrics Explorer](/investigate/querying/metrics) with the active tab's query. * Click [**Analyze anomaly (DDx)**](/investigate/analyze/differential-diagnosis) to analyze the data with Cortex XCOR Differential Diagnosis. * On narrower screens, click the three vertical dots icon to find actions that don't appear as direct buttons. * Hold the pointer over the chart to display an additional three vertical dots icon with additional [common panel actions](/observe/dashboards/panels#common-panel-elements). The **Open in explorer** and **Show query** controls reflect whichever tab is active. When viewing the **Evaluated data** tab, the explorer link and query preview display the `ALERTS_VALUE` query. When viewing the **Stored data** tab, they display the alert's source query. ### Late-arriving data notice A warning banner can display with the alert's time series chart to indicate that late-arriving data might have affected the alert. This banner appears on the **Stored data** tab, and on the **Availability** tab for SLO alerts, in the following situations: * The firing alert's data is delayed: For an actively firing alert, the most recent data point for the firing series is older than the rate at which the data usually updates. The banner reports how old the latest data point is and the expected update cadence, and cautions that the alert might have triggered on incomplete data. Check the alert again in a few minutes, after the data catches up. * Stored data no longer meets the triggering condition: Late-arriving data changed the stored result after the monitor or SLO evaluated it. Use the **Evaluated data** tab to see the values recorded when the alert triggered. If either situation happens regularly, add an offset to your query to account for ingestion delays. For more information, see [Add offsets to your query](/investigate/alerts/troubleshooting#add-offsets-to-your-query). ### Chart and series tables In the time series table, select from visualized series to highlight them in the visualization, and you can use the **Search series** query box to filter the list. You can also toggle between two views. The default ** table view**, lists the time series' status as an icon and its labels and their values. The ** list view** lists only each series' status and the query that produces it. You can optionally reveal the **Conditions** that triggered the alert. Cortex XCOR lists these conditions as a table of each condition's status, operator, sustained duration, time to resolution, and the signals to which the alert's conditions apply. ### SLO panels If the alert's source is an SLO, the alert details page also reproduces the SLO's **SLI breakdown** and **Burn/Error rates** sections for reference. For more information, see [Service level objectives](/observe/slo). ## Mute an alert To mute an alert, create a [muting rule](/investigate/alerts/muting-rules). You can do this directly from an alert details page by clicking the **Mute alert** button. This opens a panel to [create a muting rule](/investigate/alerts/muting-rules#create-a-muting-rule) that's populated with the alert's relevant source and name, and without requiring you to leave the alert details page. If a muting rule is already muting a triggered alert, clicking this button instead opens a panel to edit the associated muting rule. Alternatively, you can select ** Alerting > Muting Rules** in the navigation menu to create new muting rules or edit existing muting rules. However, doing so doesn't populate the muting rule with details from a specific alert's source. ## Define the alert detail view's time range You can customize the chronological scope of an alert's details by selecting a [time range](/navigate/time-ranges), which defaults to the **Last 1 hour**. The chart and time series table update to depict time series data only within the selected time range, but the alert's status always displays its current state. Selecting a time span that lacks data related to the alert can cause the alert's tables or visualizations to report **No data**. Confirm that the time range selector is set to a range relevant to the alerting event. ## View an alert's history The **Alert history** section on the alert details page lists past instances of the same alert. Past instances are previous occurrences with the same signal labels from the same monitor or SLO. Each past instance appears as a link labeled with the relative time it was created, such as `2 hours ago`. Click any link to navigate to that instance's alert details page. The current instance is labeled with the relative time followed by **(This instance)** and can be expanded to show the events associated with it. If more recent instances exist outside the initially loaded window, a **Show more recent alerts** button appears at the top of the list. ## Navigate to an alert's source Each alert detail page includes a link to the source of its trigger. An alert triggered by a monitor has a **Source monitor** link, and an alert triggered by an SLO has a **Source SLO** link. If you navigate to an alert's source, you can return to the alert either by clicking the triggered alert in the source entity. You can also return to the [alerts list](#view-the-list-of-alerts) and filter it by the alert's title. ## Investigate an alert with Operator This feature is in Early Access (EA), and might not be visible in your app. To learn more about this program and the features it contains, see the [Early access](/early-access) page. [Operator](/navigate/operator) reads triggered and resolved alerts, and explains what changed around one. Because it knows which alert page you're viewing, you can ask about the open alert without identifying it. To investigate the open alert, click ** Ask Operator** in the page header or press A, and then describe what you want to know. For example: Why did this alert trigger, and what changed in the 30 minutes beforehand? Operator correlates the alert's signal against logs, traces, and [change events](#examine-an-alerts-related-change-events). This feature isn't available to all Palo Alto Networks Cortex XCOR users and might not be visible in your app. For information about enabling this feature in your environment, contact [Cortex XCOR Support](/support). Operator can start a deep investigation that runs while you continue triaging. See [Start an investigation](/navigate/operator/capabilities#start-an-investigation). When a report is ready, you can [save it as a new notebook](/navigate/notebooks#save-an-investigation-report). Generative AI features can produce incorrect results, hallucinate data, and deliver inaccurate analysis. Use generative AI features with care, and independently verify all information produced by generative AI tools before applying it. Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on generative AI features or responses for any uses that exceed their designed scope. ## Examine an alert's related change events If you've [enabled change events](/observe/enable-events), the alert details page displays associated events in the time series chart and lists them in the **Change events** section. To configure which change events appear in the chart, click ** Events** to open the **Display events** panel. Under **Change events**: * Toggle **Show event markers** to show or hide event markers on the chart. * Use the **Code** or **Builder** mode toggle to configure the change events query. In **Builder** mode, use the category table to select which event categories to display. Click **Save** to apply your changes. The change events list includes each [Alert change event](/overview/concepts/change-events) related to the displayed alert. The section's table lists events that occurred during the selected time span in chronological order, starting with the most recent event. To view a change event's details, click the event's row in the list to open its **Change event** panel. This displays the event's title, category, source, type, time of occurrence, and label names and values. It also links to the alert's source and provides tabs to **Comments** and the change event entity's **JSON** depiction. To further explore all listed change events, click **Open explorer** in the alert details page's **Change events** section. Clicking this link opens [Changes Explorer](/overview/concepts/change-events) and populates it with the same time range and query used to populate the alert details page's list of change events. ## View an alert's related information The **Alert information** sidebar identifies the [collection](/administer/collections) identified as the alert's **Owner** and its associated **[Team](/administer/accounts-teams/teams)**. If the alert's source is an SLO, this section also lists the SLO's **Runbook** link if one is defined. When designing collections and teams, add contextual links, details, and default notification policies to ensure that responders can quickly identify and notify responsible colleagues or follow established policies and processes when an alert is triggered. The **Additional information** section of the sidebar lists any **Annotations** defined on the alert's triggering source. For example, if you defined [annotations](/investigate/alerts/monitors/monitor-annotations) or [templated links](/investigate/alerts/monitors/annotation-links) on a monitor or SLO, the alert's additional information lists each entry and populates any variables defined in them. Link-valued annotations render as clickable links scoped to the alert's time range when the destination supports it. When designing something that can trigger an alert, such as a monitor or SLO, use annotations to conditionally contextualize these alert views with information pertinent to responders. ### Monitor or SLO information The sidebar includes **Monitor information** or **SLO information**, depending on whether the alert was triggered by a [monitor](/investigate/alerts/monitors) or [service level objective (SLO)](/observe/slo). This card shows the source's current status and other alerting signals active on that same source. * **Current status**: The overall state of the source monitor or SLO. * **Status** and **Signal values**: A table of other actively alerting signals from the same source. The table excludes the signal for the alert you're viewing. Each **Signal values** entry links to that signal's alert details page. Hover over an entry to see its full label key-value pairs. A footer displays the count of other alerting signals on the source, for example, `3 related alerts`. If the source has more than 10 other alerting signals, a **Signal labels** field appears so you can filter the table to specific label key-value pairs. If no other signals are firing on the source, the card displays `No other alerting signals found for this monitor` or `No other alerting signals found for this SLO`. If the source monitor or SLO is unavailable, the card displays `Source monitor unavailable` or `Source SLO unavailable`. Click **Open details** to open the source [monitor](/investigate/alerts/monitors/monitor-details) or [SLO](/observe/slo) detail page. ## Document an alert's resolution When an alert is resolved, document its resolution in the alert's **Resolution notes** section. These notes can provide context to identify recurring issues and capture actions for incident reviews. ### View resolution notes The alert details page's **Resolution notes** section lists any resolution notes associated with an alert. In addition to the note's contents, each resolution note includes: * The user ID of the note's author. * The date and time that the note was added. * An **(edited)** indicator, if the note was edited. * The note's associated signals. * The date and time of the alert's most recent resolution at the time the note was added. You can [filter the list of resolution notes](#filter-resolution-notes), [edit a note](#edit-a-resolution-note), or [delete a note](#delete-a-resolution-note). ### Add a resolution note You can add multiple resolution notes to an alert. To add a resolution note from an alert details page: 1. Click **+ Add** to open the **Create resolution note** panel. 2. Enter the note in the **Resolution note** field. The field accepts Markdown formatting, with shortcut buttons for Bold, Italics, code, and links. To preview formatting, enable the **Show preview** toggle. 3. Click **Create** to create the note, or **Cancel** to return to the alert details page. ### Edit a resolution note To edit a resolution note: 1. Click ** Edit resolution note** for the note you want to edit. 2. Edit the resolution note's contents. 3. Click **Save** to save the changes, or **Cancel** to return to the alert details page. ### Delete a resolution note To delete a resolution note: 1. Click ** Delete resolution note** for the note you want to delete. 2. Click **Delete** to confirm that you want to delete the note. ### Filter resolution notes You can filter resolution notes [by signal](#filter-notes-by-signal) or [by text](#filter-notes-by-text). #### Filter notes by signal By default, the alert details page filters resolution notes by the actively firing signal. Toggle **Show current signal only** off to include notes from all alert instances on the same source. Duplicate notes can appear if the same note was added to more than one instance. #### Filter notes by text To filter resolution notes by their contents: 1. On the alert details page, click the **Search resolution notes** field. 2. Enter text to display only the resolution notes that contain that text. ## Related topics - [Monitor details](/investigate/alerts/monitors/monitor-details.md) - [Respond to incidents](/overview/guides/incident-response.md) - [Manage service level objectives](/investigate/alerts/manage-slos.md) - [Overview of alerting](/investigate/alerts.md) - [Add templated links to monitors](/investigate/alerts/monitors/annotation-links.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.