Alerts
Create alert rules on your collected data, get notified by email, Teams, Slack or webhook, and snooze or resolve alerts with a reason.
Alerts tell you when something in your tenant needs attention. Open Alerts in the sidebar. The page lists the open alerts first, then the rules that raise them and the channels that deliver them.
Kairavo evaluates every enabled rule once a minute while the app is running. Alerts are sent from your computer, so nothing is evaluated or delivered while Kairavo is closed.
Rule kinds
Every rule has a Condition type:
| Condition type | What it watches | Measures |
|---|---|---|
| Threshold | A value crosses a limit, for example more than 10% noncompliant devices. | Non-compliant percentage, Non-compliant devices, Resource count |
| Percentage change | A value changes by more than a percentage between two complete observations. | Non-compliant percentage, Non-compliant devices, Resource count |
| Collection absence | Data for a source has not been collected for too long. | Minutes since collection |
| Captured expiry | A date captured from your tenant comes close. | Days to captured expiry |
Captured expiry works with the expiry dates of groups, Apple VPP tokens and Apple enrollment tokens, and with the end of support date of feature update profiles.
Built-in rules
Each tenant starts with four rules:
- Managed device collection is over two hours old
- Apple VPP token expires within 30 days
- Apple enrollment token expires within 30 days
- Feature update profile reaches end of support within 90 days
They are marked Editable default. Change them with Edit rule, or turn one off with Pause rule.
Create an alert rule
Scroll to Create an alert rule under Rules and evaluation.
Enter a Rule name and pick a Condition type.
Pick the Measure and the Source. The noncompliance measures always read Managed devices.
Pick a Comparison (Above, At least, Below or At most) and enter the Trigger value. For Percentage change, the field is called Percentage change.
Set Condition duration (minutes): how long the condition must hold before the alert fires. Use 0 to fire right away.
Set Evidence freshness (minutes): how old the collected data may be before the rule treats it as stale. The default is 120 minutes.
Pick a Severity: Information, Warning or Critical, and select Create rule.
The rule list shows the state of each rule and the reason for it. To change a rule, select Edit rule, make the changes and select Save rule changes.
Missing or stale data never counts as a recovery. An alert closes on its own only after two healthy evaluations at least one minute apart.
Set up delivery channels
A channel sends alerts to email, Microsoft Teams, Slack or your own HTTPS endpoint. Credentials such as webhook URLs and API keys never go into the channel form. You save them as an integration secret on your computer, then enter the secret's name in the channel.
Step 1: save the secret
Open the Kairavo settings, where you sign in to tenants. Go to Preferences and find Integration secrets.
In Add an integration secret, enter a Name that starts with IM_DELIVERY_, for example IM_DELIVERY_TEAMS_OPERATIONS. Use capital letters, digits and underscores.
Paste the Secret value for your channel type (see the table below) and select Save secret.
Secrets stay encrypted on your computer. A saved value is never shown again. To change it, select Replace.
| Channel type | Secret value |
|---|---|
| Microsoft Teams Adaptive Card | The complete incoming webhook or Teams Workflows URL. |
| Slack Block Kit | The complete Slack incoming webhook URL. It starts with https://hooks.slack.com/services/. |
| HTTPS webhook | A signing secret of your choice. Kairavo signs every request with it (see below). |
| Email with Resend | Your Resend API key. |
| Email with SMTP | Your relay settings as JSON (see below). |
Step 2: configure the channel
On the Alerts page, go to Delivery channels and stay on the Channels tab.
Enter a Channel name and pick a Channel type: HTTPS webhook, Microsoft Teams Adaptive Card, Slack Block Kit or Email.
Fill in the fields for the type:
- HTTPS webhook: the Webhook URL. It must start with
https://. - Email: the Email delivery provider (Your Resend account or Your SMTP relay), the Verified sender address and the Recipients, one to five addresses separated by commas.
- Teams and Slack need no extra fields. The URL is the secret.
Enter the Delivery secret name you saved in step 1, for example IM_DELIVERY_TEAMS_OPERATIONS.
Select Configure channel.
Kairavo does not send a test message. Recent delivery attempts shows each delivery with its state, the number of attempts and any error. Failed deliveries that can be retried back off for at most six hours.
Snooze or resolve an alert
Every open alert in the list has Manage alert.
Open Manage alert on the alert.
Pick an Action: Snooze or Resolve.
For Snooze, pick how long in Snooze for: 1 hour, 4 hours, 1 day or 7 days.
Enter a Reason to record the context for your team. The reason is required.
Select Snooze alert or Resolve alert.
Resolving an alert does not turn off its rule. Kairavo keeps evaluating the source condition.