> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor details

> View and interpret the monitor detail page, including query results, alert history, and change events.

When you select a monitor from the [monitors list](/investigate/alerts/monitors#view-available-monitors),
Palo Alto Networks Cortex XCOR opens the monitor's detail page. The detail page shows the
monitor's current alert state, a visualization of its query and triggered alerts over
time, and tools to investigate and act on those alerts. To query monitors or retrieve
alert history programmatically, see
[Monitor actions](/investigate/alerts/monitors/monitor-actions).

Click <Icon icon="link-2" /> **Copy URL** in the page header to copy a shareable URL
to your clipboard. Share it with teammates so they can view the same page directly.

## Review a monitor's status

The detail page leads with the monitor's current **Status**, which shows the number
of active alerts at each severity and whether any notifications are muted:

* **Passing** indicates that no series tracked by the monitor is actively triggering
  an alert.
* If any alerts are muted, a banner describes the muting. Click **More details**
  to see links to the active
  [muting rules](/investigate/alerts/muting-rules) that are silencing notifications.
* If a notifier or notifier connection on a matching route for a notification policy
  has delivery failures, a banner identifies the affected target and describes
  the cause. See
  [Identify failed notification
  delivery](/investigate/alerts/notifications#identify-failed-notification-delivery)
  for remediation steps.

The monitor's **Signal labels** appear next to the status indicator and indicates which
label values the monitor is currently tracking.

## Alerting signal limit

Each monitor can track up to 5,000
[alerting signals](/investigate/alerts/notifications/signals).

When a monitor reaches the limit, Cortex XCOR continues to process
previously tracked signals but blocks new signals. Blocked signals don't generate
notifications or appear in alert history.

The monitor detail page displays a `Signal limit reached` warning with the configured
limit and the number of blocked signals.

To resume processing new signals, reduce the number of signals that meet the monitor's
alert conditions:

* Remove labels with many distinct values from the monitor's signal grouping. Labels
  that identify pods, instances, requests, or traces can create a separate signal for
  each value.
* Narrow the monitor query to return only the intended time series.
* Split a broad monitor into targeted monitors. Each monitor has its own signal limit.

## Query results

The **Query results** section visualizes the time series data returned by the
monitor's query as a
[time series chart](/observe/dashboards/panels/time-series-chart).

Use the following controls to adjust the visualization:

* **All**, **Alerting**, or **Critical**: Filter which series display on the chart by
  alert state.
* **<Icon icon="clock" /> [Time range selector](/navigate/time-ranges)**: Define the
  time span of data visualized in the chart.
* **Show thresholds**: Draw horizontal lines on the chart depicting the monitor's
  triggering thresholds.
* **Show query**: Display the query that populates the chart.
* **Open in explorer**: Open
  [Metrics Explorer](/investigate/querying/metrics/explorer) populated with the
  monitor's query.
* **Analyze anomaly (DDx)**: Right-click or long-press a series to perform
  [Cortex XCOR Differential Diagnosis (DDx)](/investigate/analyze/differential-diagnosis)
  on it.

If the monitor uses
[signal grouping](/investigate/alerts/monitors/data-model#signals),
a **Group by signal** toggle appears to group series by their signal labels.

If you've [enabled change events](/observe/enable-events), an
**<Icon icon="layers" /> Events** control appears to configure which change events
overlay the chart. See [Change events](#change-events).

### Series legend

The series legend lists all metrics displayed in the chart, in either list or table
view. Both views show the label keys and values for each series. The **Alert status**
column shows each series' current alert state as a link. The link text is
**Critical**, **Warning**, **Muted**, **Resolved**, or **Passing**. Click the link
to open that series' [alert details](/investigate/alerts/alert-details) page. A series
might be **Muted** due to an active muting rule. For more information, see
[per-series muting status](/investigate/alerts/muting-rules#view-per-series-muting-status-on-a-monitor).

Filter and interact with the series legend:

* Use **Search Series** to filter the displayed series by text.
* Click a series color to isolate that line on the chart. Click again to clear the
  selection. Use `Control+`click (`Command+`click for macOS) to select multiple
  series.
* In a label column, hold the pointer over a cell to reveal the
  **<Icon icon="zoom-in" /> Add** or
  **<Icon icon="zoom-out" /> Remove label from filters** icons. These filters apply
  only when the time series includes *all* filtered labels.

## Active alerts list

The **Active alerts list** card shows all currently active alert instances for the
monitor. The card header displays the total count, for example
**Active alerts list (3)**. Each entry links to the corresponding
[alert details](/investigate/alerts/alert-details) page.

If the monitor has no active alerts, the card displays
`This monitor does not have any active alerts.`

## Alert history

The alert history log shows every alert generated by the monitor. To open it, click
**Alert history** in the actions menu. To query alert history programmatically, see
[Monitor actions](/investigate/alerts/monitors/monitor-actions).

Each entry shows the alert's timestamp, event type, and details including its
signals and notifiers.

* To sort, click a column header.
* To filter by event type, click the **Event types** dropdown and select the event
  types to display. Use the **Search** field in the dropdown to find a specific type.
* To toggle the signal scope, switch between the currently selected signal and all
  signals for the monitor.
* To view an alert's JSON payload, click the **>** icon on the alert's row. Click
  the <Icon icon="copy" /> icon to copy the payload.

To document why a resolved alert triggered and what actions were taken, add
[resolution notes](/investigate/alerts/alert-details#document-an-alerts-resolution)
from the alert details page.

<Note>
  There can be up to a five-minute delay between when an alert resolves and when
  Cortex XCOR sends the resolution notification.
</Note>

### Alert event payload

The JSON payload captures the values at the time the alert triggered. The payload
fields are primarily defined in the
[monitor data model](/investigate/alerts/monitors/data-model).

* `monitorSlug`: The monitor's unique
  [slug](/investigate/alerts/monitors/data-model#slug).
* `eventType`: The type of event triggered. Valid alert event types are:
  * Alert triggered
  * Alert resolved
  * Notification sent (alert triggered)
  * Notification failed (alert triggered)
  * Notification sent (alert resolved)
  * Notification failed (alert resolved)
  * Alert muted
  * Alert unmuted
* `createdAt`: The time the alert triggered.
* `signal`: See [signals](/investigate/alerts/monitors/data-model#signals). Contains
  one or more `name` and `value` entries.
* `details`: Contains `severity` as defined by the
  [notification policy](/investigate/alerts/notifications/policies) and
  [`notifier`](/investigate/alerts/notifications/notifiers).
  `notifier` values contain the notifier `name` and `slug`.

## Change events

If you've [enabled change events](/observe/enable-events), the query results chart
can overlay associated events using
[category icons](/observe/enable-events/use-events#categorize-change-events-intentionally).

To configure which change events appear:

1. Click **<Icon icon="layers" /> Events** to open the **Display events** panel.
2. Toggle **Show event markers** to show or hide event markers on the chart.
3. Toggle **Filter by entity** to limit events to those related to this monitor.
4. Use the **Code**, **Builder**, or **Event presets** mode to configure the
   change events query. **Event presets** appears only when presets are configured
   for the monitor.
5. Click **Save**.

For more information about change event details, see
[Change event details](/observe/enable-events/use-events#change-event-details).

## Monitor information

The monitor detail page includes a sidebar with reference information about the
monitor's configuration:

* **Monitor information**: The [collection](/administer/collections) assigned as its
  **Owner**, the **Team** responsible for it, and its **Notification policy**.
* **Datasource** and update **Interval**.
* **Additional information**: **Labels**, **Description**, and
  [templated links](/investigate/alerts/monitors/annotation-links) from the monitor's
  annotations, giving on-call engineers direct access to runbooks, related dashboards,
  and documentation.


## Related topics

- [Monitor actions](/investigate/alerts/monitors/monitor-actions.md)
- [Use annotations with monitors](/investigate/alerts/monitors/monitor-annotations.md)
- [Use monitors to generate alerts and notifications](/investigate/alerts/monitors.md)
- [Datadog migration considerations](/ingest/metrics-traces/collector/mappings/datadog/migration-issues.md)
- [Reuse label selections with Quick filters](/navigate/quick-filters.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.