Main Fields
| Field | Description |
|---|---|
| subject | Alert subject, derived from the alert title and identical to the subject used in alert emails. |
| severity | Highest severity among the alerts included in the webhook. Possible values: info, low, medium, high, critical. |
| description | Description of the alert whose title is used as the subject. |
| investigationUrl | Link to the Anoboard in Anodot for further investigation. |
| triageUrl | Link to the triage page for the specific alert trigger. |
| startTime | Human-readable start time of the first alert in the anomaly. |
| startTimeEpoch | startTime represented as an epoch timestamp. |
| timescale | Alert timescale. Possible values: 1min, 5min, 1 hour, 1 day, 1 week. |
| type | Alert type. Possible values: Anomaly, Static, No Data. |
| mergedAnomalies | Array of all merged anomalies. |
| alerts | Array of all alerts included in the triggered instance. |
| metrics | Array of all metrics included in each alert. |
| direction | Direction of the anomaly: up, down, or both. If both, the upper and lower directions are relevant. |
| delta | Included for backward compatibility. |
| name | Metric name, including tags and user-defined names for composite metrics. |
| id | Metric ID. |
| state | State of the specific metric. Possible values: OPEN, CLOSED. |
| season | Metric seasonality. None indicates no seasonality. Other possible values: 2w, 1w, 1d, 12h, 6h, 5h, 4h, 3h, 2h, 1h, 30m, 15m, 10m, 5m. |
| events | User events correlated with the alert during the time range of the alert metrics. |
| buckets | Array of events grouped by date. |
| topEvents | Top correlated events for the alert. |
| alertid | Specific alert ID. |
| AlertSettingsURl | Link to the specific alert configuration. |
| description | Description of the specific alert. |
| severity | Severity of the specific alert. Possible values: info, low, medium, high, critical. |
| alertGroupId | Unique identifier for the entire incident. All notifications related to the same incident, such as open, update, and close, share the same alertGroupId, allowing them to be grouped together. |