> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Customize monitor notification messages

> Use notification templates to control the title and description of notifications generated by a monitor.

Use notification templates to control the title and description of
notifications generated by a monitor. Templates are Go template strings
expanded at notification time with alert context, so the notification can
include signal data such as severity, labels, and threshold values.

A notification template has two optional fields:

* Title: The subject line or heading of the notification.
* Description: The body text of the notification.

To add a notification template to a monitor, see
[Create a monitor](/investigate/alerts/monitors#create-a-monitor) or
[Edit a monitor](/investigate/alerts/monitors#edit-a-monitor). For the
`notification_template` field definition, see the
[monitor data model](/investigate/alerts/monitors/data-model#notification-template).

## Set a notification template

Add a `notification_template` block when creating or updating a monitor.

<Tabs>
  <Tab title="Web UI" id="notification-template-ui">
    When you [create](/investigate/alerts/monitors#create-a-monitor) or
    [edit](/investigate/alerts/monitors#edit-a-monitor) a monitor, use the
    **Notification Template** section to set the title and description of the
    notifications this monitor generates. Enter Go template strings that combine
    literal text with `{{...}}` placeholders, which expand with alert context at
    notification time.

    1. In the **Title** field, enter a template for the notification title.
    2. In the **Description** field, enter a template for the notification body.

    Both fields are optional.
  </Tab>

  <Tab title="Chronoctl" id="notification-template-chronoctl">
    Include a `notification_template` block in your monitor YAML when running
    `chronoctl monitors create` or `chronoctl monitors update`. For more
    information, see [Chronoctl](/tooling/chronoctl).

    ```yaml theme={null}
    notification_template:
      title: "[{{.Severity}}] {{.Labels.service}} — error rate alert"
      description: >-
        Service {{.Labels.service}} in {{.Labels.env}} fired
        {{.ThresholdOp}} {{.Threshold}}. Status: {{.Status}}.
    ```
  </Tab>

  <Tab title="Terraform" id="notification-template-terraform">
    Add a `notification_template` block to your `chronosphere_monitor` resource.
    For more information, see the
    [Terraform provider](/tooling/infrastructure/terraform) documentation.

    ```terraform Terraform example icon="square-terminal" theme={null}
    resource "chronosphere_monitor" "example" {
      name = "High error rate"

      notification_template {
        title       = "[{{.Severity}}] {{.Labels.service}} — error rate alert"
        description = "Service {{.Labels.service}} in {{.Labels.env}} fired {{.ThresholdOp}} {{.Threshold}}. Status: {{.Status}}."
      }
      # ...
    }
    ```
  </Tab>

  <Tab title="API" id="notification-template-api">
    Set the `notification_template` field on the monitor body when calling
    [`CreateMonitor`](/tooling/api-info/definition/operations/CreateMonitor)
    or the equivalent update endpoint.

    ```json theme={null}
    {
      "monitor": {
        "name": "High error rate",
        "notification_template": {
          "title": "[{{.Severity}}] {{.Labels.service}} — error rate alert",
          "description": "Service {{.Labels.service}} in {{.Labels.env}} fired {{.ThresholdOp}} {{.Threshold}}. Status: {{.Status}}."
        }
      }
    }
    ```
  </Tab>
</Tabs>

## Error rate alert example

The following template uses severity and label variables to produce a
notification title and description.

```json theme={null}
{
  "title": "[{{.Severity}}] {{.Labels.service}} threshold exceeded",
  "description": "{{.Labels.env}} crossed {{.ThresholdOp}} {{.Threshold}}"
}
```

For a critical alert on the `payments` service in `production` , Palo Alto Networks Cortex
XCOR renders
the notification as:

```text theme={null}
[critical] payments threshold exceeded
production crossed >= 0.95
```

## Template variables

Reference variables with dot notation, for example, `{{.Severity}}`.

| Variable | Type | Description |
| - | - | - |
| `.Severity` | string | Alert severity: `"critical"` or `"warn"`. |
| `.Status` | string | Alert state: `"firing"` or `"resolved"`. |
| `.Labels.<name>` | string | Signal labels attached to the alert. For example, `.Labels.env` or `.Labels.service`. |
| `.Threshold` | number | Threshold value for the active severity condition. |
| `.ThresholdOp` | string | Comparison operator for the active condition. For example, `">="` or `"<"`. |
| `.ResolveThreshold` | number | Effective resolve threshold. Defaults to `.Threshold` when no separate resolve threshold is configured. |
| `.StartsAtEpoch` | integer | Start time of the earliest alert in `.Alerts`, in epoch milliseconds. |
| `.Alerts` | list | All alerts in the notification group. See [Alert object fields](#alert-object-fields). |
| `.Alerts.Firing` | list | Subset of `.Alerts` that are currently firing. |
| `.Alerts.Resolved` | list | Subset of `.Alerts` that have resolved. |

### Alert object fields

Each item in `.Alerts`, `.Alerts.Firing`, and `.Alerts.Resolved` exposes the
following fields:

| Field | Type | Description |
| - | - | - |
| `.Status` | string | Alert state: `"firing"` or `"resolved"`. |
| `.Labels` | map | Per-alert label key-value pairs. |
| `.Annotations` | map | Per-alert annotation key-value pairs. |
| `.Threshold` | number | Per-alert threshold value. |
| `.ThresholdOp` | string | Per-alert comparison operator. |
| `.ResolveThreshold` | number | Per-alert effective resolve threshold. |
| `.StartsAt` | timestamp | Time the alert started firing. |
| `.EndsAt` | timestamp | Time the alert resolved, if applicable. |

## Template functions

In addition to the standard Go template built-ins, the following functions are
available.

### Arithmetic

| Function | Description | Example |
| - | - | - |
| `add` | Adds two integers. | `{{add 1 2}}` returns `3` |
| `sub` | Subtracts two integers. | `{{sub 5 3}}` returns `2` |
| `mul` | Multiplies two integers. | `{{mul 3 4}}` returns `12` |

### String manipulation

| Function | Description | Example |
| - | - | - |
| `toUpper` | Converts a string to uppercase. | `{{toUpper .Labels.env}}` returns `PRODUCTION` |
| `toLower` | Converts a string to lowercase. | `{{toLower .Labels.env}}` returns `production` |
| `title` | Title-cases a string. | `{{title .Labels.env}}` returns `Production` |
| `join` | Joins a string slice with a separator. | `{{join .Labels.regions ", "}}` |
| `match` | Returns `true` if a string matches a regular expression. | `{{match "^prod" .Labels.env}}` |
| `reReplaceAll` | Replaces all regexp matches in a string. | `{{reReplaceAll "-" "_" .Labels.service}}` |

## Template examples

### Count firing and resolved alerts

```text theme={null}
{{len .Alerts.Firing}} firing, {{len .Alerts.Resolved}} resolved
```

### List all firing alerts

```text theme={null}
{{range .Alerts.Firing -}}
- {{.Labels.service}} ({{.Labels.env}})
{{end}}
```

### Show the resolve threshold conditionally

```text theme={null}
Threshold: {{.ThresholdOp}} {{.Threshold}}
{{- if ne .ResolveThreshold .Threshold}} (resolves at {{.ResolveThreshold}}){{end}}
```

### Reference the alert start time

```text theme={null}
Alert started at epoch ms: {{.StartsAtEpoch}}
```


## Related topics

- [Monitor data model](/investigate/alerts/monitors/data-model.md)
- [Alert notifications](/investigate/alerts/notifications.md)
- [Convert Datadog monitors](/ingest/metrics-traces/collector/mappings/datadog/convert-monitors.md)
- [Monitor actions](/investigate/alerts/monitors/monitor-actions.md)
- [Get started with Cortex XCOR](/overview/get-started.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.