Manage severity escalation notifications for the experimental alerting system

Not every severity change fires a notification. The outcome depends on whether the action policy has already matched the episode and which frequency option you've selected.

Scope an action policy to the severity level you want notifications for. When an episode escalates into that severity level for the first time, the action policy fires because it has no prior notification record for the episode.

The following example uses an action policy scoped to severity: "critical". An episode starts at low severity, so the action policy doesn't match. When the episode escalates to critical, the action policy now matches and fires regardless of the frequency setting, because it has never notified for this episode before.

If an action policy already matched an episode at a lower severity and the episode escalates, the action policy doesn't automatically re-notify. With On status change frequency, a severity change alone doesn't count as a status change.

In this example, Action Policy A matches all episodes regardless of severity. It notified when the episode was low. The episode escalates to critical, but Action Policy A still matches and the status hasn't changed, only the severity has. The throttle blocks re-notification. To re-notify on escalation, use a time-based throttle or create separate action policies for each severity level as described in Route alert episodes by severity.

If an episode drops below an action policy's severity threshold, the action policy stops matching and sends no further notifications. If the episode later escalates back above the threshold, the action policy fires again as if it were the first match.

In this example, Action Policy B targets only severity: "critical" episodes. An episode de-escalates from critical to high. Action Policy B no longer matches and stops sending notifications. If the episode later escalates back to critical, Action Policy B fires again.

• Route alert episodes by severity for configuration examples that use severity-scoped action policies to separate routing destinations.
• Re-notify for persistently active episodes for time-based throttle options that re-notify when an episode stays active.
• Action policy reference for match condition fields and frequency options.