On-call & Incident Response
Moneat includes a built-in on-call and incident-response system. When critical errors or uptime failures are detected, Moneat can raise on-call alerts, notify the right people, and coordinate a native incident when a problem needs a shared response. Notifications can be sent through push notifications, Slack DMs, email, SMS, and voice calls.
Choose a guide
The On-call area is organized around the decision or response step you are working on:
| Need | Guide |
|---|---|
| Bring a team from zero to its first page | Get started |
| Define duty, rotations, layers, and coverage | Schedules & coverage |
| Decide which alerts page or create incidents | Routing & escalation |
| Configure and understand alert delivery | Alerts & alert sources |
| Coordinate an incident and finish the response record | Incidents & postmortems |
| Configure channels and verify that pages arrive | Paging & reliability |
| Connect Slack and coordinate shared communication | Slack & integrations |
| Manage operational settings, migration, and administration | Administration |
| Diagnose a missing page, incident, or delivery | Troubleshooting |
The product surfaces these workflows separately under On-Call. The most common routes are Alerts, Incidents, Schedules, Coverage, Paging, and Reliability.
How the response system fits together
- A Moneat telemetry rule or an alert source raises an on-call alert.
- An Alert Route decides whether the alert is grouped, paged, or used to create a native incident.
- An escalation policy tries the configured responders in order until somebody acknowledges the page.
- Responders work from the alert or incident record, using the dashboard, mobile app, or Slack.
- A native incident carries coordinated ownership, evidence, communication, and follow-up work.
- The team closes the response through post-incident work and postmortems.
Core concepts
Moneat keeps closely related concepts distinct so counts, links, and automation stay unambiguous:
- On-call alert — a page routed to a responder through an escalation policy. It moves through triggered → acknowledged → resolved. Responders can acknowledge it from Alerts, the mobile app, or a Slack DM. Resolve it from the alert detail page or the mobile app; the detail view is the source of truth for the full alert record.
- Native incident — a declared incident that Moneat coordinates end to end. It carries a severity, an ownership timeline, and its own lifecycle (triage → active → resolved → post-incident → closed, with cancelled and declined as terminal states), and it can link one or more on-call alerts. Declared incidents live in the Incidents view.
- Alert episode — one source-neutral firing of an alert rule, from first breach through resolution or suppression. Episodes are how repeated notifications for the same condition are grouped.
- Forwarded provider incident — an incident that originates in an external incident tool. Moneat delivers and synchronizes it but treats the provider as the system of record.
- Alert source — a configured connection that lets an outside system raise alerts in Moneat, with its own ingress endpoint, token, and delivery history. Alerts arriving through a source follow the same lifecycle and Alert Route evaluation as alerts Moneat raises itself.
A single on-call alert can page you without ever becoming a native incident. Declaring an incident is a deliberate step you take when a problem needs coordinated response.
URL compatibility
The older product routes /on-call/readiness, /on-call/paging-reliability, /on-call/response-outcomes, and /on-call/incident-configuration redirect to the current surfaces. The documentation links in this section point to those current surfaces and the task guides that explain them.