Routing & Escalation

Routing decides which response path owns an alert. Escalation decides who is tried and how long Moneat waits before moving to the next step.

Escalation policies

Open On-Call → Escalation to create an ordered policy. Each step specifies who to notify and how long to wait before escalating. A typical policy might:

1. Notify the primary on-call through push notification and Slack.
2. Notify the secondary on-call after five minutes without acknowledgement.
3. Notify the engineering manager after another ten minutes.

Priority levels

Business hours

Teams can configure business hours. An escalation policy can behave differently during and outside working hours, including using different timeouts.

Alert Routes

Automatic incident creation is configured separately through ordered Alert Routes:

• An enabled route must explicitly turn on Create an incident for matched alerts. A route that only pages or groups alerts will not create an incident.
• If no route matches, the alert remains an alert episode: it is not paged by a route and no incident is opened.
• Routes are evaluated in order. A first matching page-only route prevents later routes from handling the alert, so put incident-capable routes before catch-all paging routes.
• The route editor and test-alert result identify whether no route matched, paging occurred, grouping occurred, an incident was skipped, or a triage incident was created.
• The administrator test-alert response is action-specific: a successful alert request does not imply an incident. Review the route state, matched route revision, group, paging result, and incident result separately.
• The editor includes an opt-in P0–P2 triage preset. It pages once per group, creates triage incidents, and derives SEV-0, SEV-1, or SEV-2 from P0, P1, or P2; fixed-severity route settings are unchanged.
• An on-call alert detail shows the matched route revision and independent grouping, paging, and incident outcomes with the reason when an action is skipped or fails.
• Manual Declare Incident remains available independently of Alert Route automation.

Route configuration

Alert Routes are evaluated from top to bottom. The first enabled route whose conditions match owns the alert; later routes are not evaluated. Conditions are OR across groups and AND within a group. Put incident-capable routes above broad paging-only or catch-all routes, and use the editor's preview and test result to see which route revision would win.

Each route independently controls:

• Paging — no page, the first episode in each group, or every episode. Targets can be users, teams, on-call schedules, or escalation policies.
• Grouping — choose up to eight alert attributes as grouping keys, a fixed window anchored on the first alert, or a rolling window extended by each new alert.
• Grouping behavior — Suggested records a candidate relationship for a responder to confirm; Automatic attaches matching episodes and can create the configured incident without a manual confirmation.
• Incident creation — leave it off for an alert-only group, or enable it and choose Triage or Active. Active creation requires a fixed incident severity. Triage creation can use the alert priority sentinel to derive SEV-0, SEV-1, or SEV-2 from P0, P1, or P2.
• Recovery — choose a grace period, whether to cancel outstanding escalations, and whether an unaccepted triage incident should be declined when every member episode resolves.

An alert-only group can still page and group episodes without opening an incident. To convert an on-call alert manually, open the alert and choose Declare Incident; the new incident is linked to that alert. To convert a grouped alert episode, confirm or attach the suggested incident from the group controls, or use an automatic route with incident creation enabled.

Silences and recovery

When alert delivery is silenced, Moneat records the matched route and group but skips paging and incident actions. When all active episodes in a group resolve, the recovery worker waits for the configured grace period, cancels escalations when selected, and can decline an unaccepted triage incident. Recovery decisions remain visible in the group and incident timelines.

Test the winning route

Creating an Alert Route does not itself exercise it. Send a test alert that satisfies the route's conditions, then inspect the matched route revision, group, paging, and incident outcomes. If there are no Alert Routes, alerts remain alert episodes and no automatic incident is opened; manual declaration still works.

For outcome-specific checks, see Troubleshooting.