> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/overview/add-alert.md). # Add Alert {% hint style="warning" %} **Please note**: A new beta version of this view is available. You can find it under [Alerts (BETA)](/docs/manual/english/platform-usage/alerts-beta.md) → [Add Alert (BETA)](/docs/manual/english/platform-usage/alerts-beta/overview-beta/add-alert-beta.md). To use the new view, enable **Enable Beta Features** under Settings → [User Account](/docs/manual/english/administration/settings/user-account.md#advanced-settings). {% endhint %} *** Click **Create Alert** in the upper-right corner of the [alerts overview](/docs/manual/english/platform-usage/alerts/overview.md#alerts-overview) to create a new Alert. The **Alerts** → **Add** view opens. Click **Expand** to display all available settings for a section. Click **Collapse** to collapse an expanded section again. After configuring all settings, click **Add Alert** to save and create the new Alert. Click **Back** to return to the list view. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Alert**, all configured settings will be permanently lost. {% endhint %} *** ## Alert Type Here you can select the Enginsight component for which the Alert should be created. The metrics and scenarios that can trigger an Alert vary depending on the selected Alert type. The following options are available:

Option	Description
Host (Pulsar)	Create an Alert for a server or client on which the Enginsight Pulsar agent is running.
Endpoint (Observer)	Create an Alert for a website or domain monitored by the Enginsight Observer component.
Observation (Watchdog)	Create an Alert for an observation, such as configured SNMP, ping, or port monitoring performed by the Enginsight Watchdog component.
Watchdog (Watchdog)	Create an Alert for network device detection performed by the Enginsight Watchdog component.
SIEM Workflow (Loggernaut)	Create an Alert for a new event in the Enginsight SIEM triggered by a specific workflow.
SIEM Tracer (Model)	Create an Alert for the SIEM Tracer component, which performs AI-based time-series analysis.

*** ## General Settings The following options are available:

Option	Description
Reference (Left Field)	Specify the objects to which the Alert should apply. The default reference operator is Exclusively. Click the field to expand a list of all available options. The following options are available: Exclusively: The Alert applies only to the object specified in the Reference field. Any with Tags: An object must have the tag or tags specified below for the Alert to apply to it.
Reference (Right Field)	This option is visible only if you selected Exclusively in the reference operator field. Select the specific object to which the Alert should apply. Click the Reference field to expand a list of all available objects, then select an object. Alternatively, use the free-text input to find an object in the list more quickly.
Tags	This option is visible only if you selected All with Tags in the reference operator field. Specify the tag or tags that must be assigned to an object for the Alert to apply to it. Click the Tags field to expand a list of all available tags, then select a tag. Alternatively, use the free-text input to find a tag in the list more quickly. Click the Remove icon next to a tag to remove it from the Tags field.
Metric Attribute/Scenario	Select the specific metric or scenario that should trigger an Alert. Click the Metric Attribute/Scenario field to expand a list of all metrics and scenarios available for the selected Alert type, then select an option. Alternatively, use the free-text input to find a metric or scenario in the list more quickly. The metrics and/or scenarios available for an Alert vary depending on the selected Alert type. For more information about the specific Alerts you can create, refer to our Knowledge Base article: Welche spezifischen Alarme kann ich in Enginsight definieren?
Description	Enter a meaningful display name for the Alert.

*** ## Notifications Here you can specify which users should be notified and through which channels when an Alert is triggered. The following options are available:

Option	Description
Add a User	Select the user who should be notified when an Alert is triggered. Click the Add a User field to expand a list of all available users, then select one or more users. Alternatively, use the free-text input to find users in the list more quickly. Click the Delete icon next to an added user to remove them from the Add a User field.
Add a Group	Select the user group that should be notified when an Alert is triggered. Click the Add a Group field to expand a list of all available user groups, then select one or more groups. Alternatively, use the free-text input to find groups in the list more quickly. Click the Delete icon next to an added group to remove them from the Add a Group field.
Additional Notification via SMS	Specify that an SMS notification should be sent in addition to an email when an Alert is triggered. The notification is sent to the phone number stored in your user account. You can change it in the user account settings. Enable the toggle next to Additional Notification via SMS to allow SMS notifications. Please note: To receive SMS notifications, you must first configure this in the Enginsight configuration file. For more information about configuring SMS notifications, refer to our Knowledge Base article: Wie konfiguriere ich in Enginsight den Versand von SMS-Benachrichtigungen bei Alarmen?
Additional Notification via Slack	Specify that a Slack notification should be sent in addition to an email when an Alert is triggered. Enable the toggle next to Additional Notification via Slack to allow Slack notifications.
Slack Channel	This field is visible only if you enabled Additional Notification via Slack. Enter the webhook URL of the Slack channel through which the additional notification should be sent. Please note: To display notifications in Slack, you must first create a webhook in Slack and then add it as a webhook in the Enginsight platform. For information about creating webhooks in Slack, refer to the official vendor documentation.
Additional Notification via Mattermost	Specify that a Mattermost notification should be sent in addition to an email when an Alert is triggered. Enable the toggle next to Additional Notification via Mattermost to allow Mattermost notifications.
Mattermost Channel	This field is visible only if you enabled Additional Notification via Mattermost. Enter the webhook URL of the Mattermost channel through which the additional notification should be sent. Please note: To display notifications in Mattermost, you must first create a webhook in Mattermost and then add it as a webhook in the Enginsight platform. For information about creating webhooks in Mattermost, refer to the official vendor documentation.
Additional Notification via Microsoft Teams	Specify that a Microsoft Teams notification should be sent in addition to an email when an Alert is triggered. Enable the toggle next to Additional Notification via Microsoft Teams to allow Microsoft Teams notifications.
Teams Channel	This field is visible only if you enabled Additional Notification via Microsoft Teams. Enter the webhook URL of the Microsoft Teams channel through which the additional notification should be sent. Please note: To display notifications in Microsoft Teams, you must first create a webhook in Teams and then add it as a webhook in the Enginsight platform. For information about creating webhooks in Teams, refer to the official vendor documentation.

*** ## Automation Here you can select the webhook used to connect the Alert to third-party software, if required. You can also select a plugin to run on a specific host. The following options are available:

Option	Description
Webhooks: Webhook	Select the webhook through which the Alert should be forwarded to third-party software. Please note: Before you can select a webhook here, you must first create it under Alerts → Webhooks. Click the Webhook field to expand a list of all available webhooks, then select a webhook. Alternatively, use the free-text input to find webhooks in the list more quickly. Click the Remove icon next to an added webhook to remove it from the Webhook field.
Plugins: Host	Select the host on which the plugin selected below should run when the Alert is triggered. Please note: This list includes only hosts that have been explicitly permitted to run plugins through a policy or the host settings. If you leave this field empty, all hosts permitted to run plugins are selected automatically. Click the Host field to expand a list of all available hosts, then select a host. Alternatively, use the free-text input to find hosts in the list more quickly. Click the Remove icon next to an added host to remove it from the Host field.
Plugins: Plugin	Select the plugin that should run on the selected host when the Alert is triggered. Please note: Before you can select a plugin here, you must first add it under Hosts → Plugins. Click the Plugin field to expand a list of all available plugins, then select a plugin. Alternatively, use the free-text input to find plugins in the list more quickly. Click the Remove icon next to an added plugin to remove it from the Plugin field.

Option

Description

Webhooks: Webhook

Select the webhook through which the Alert should be forwarded to third-party software.

Please note: Before you can select a webhook here, you must first create it under Alerts → Webhooks.

Click the Webhook field to expand a list of all available webhooks, then select a webhook. Alternatively, use the free-text input to find webhooks in the list more quickly.

Click the Remove icon next to an added webhook to remove it from the Webhook field.

Plugins: Host

Select the host on which the plugin selected below should run when the Alert is triggered.

Please note: This list includes only hosts that have been explicitly permitted to run plugins through a policy or the host settings.

If you leave this field empty, all hosts permitted to run plugins are selected automatically.

Click the Host field to expand a list of all available hosts, then select a host. Alternatively, use the free-text input to find hosts in the list more quickly.

Click the Remove icon next to an added host to remove it from the Host field.

Plugins: Plugin

Select the plugin that should run on the selected host when the Alert is triggered.

Please note: Before you can select a plugin here, you must first add it under Hosts → Plugins.

Click the Plugin field to expand a list of all available plugins, then select a plugin. Alternatively, use the free-text input to find plugins in the list more quickly.

Click the Remove icon next to an added plugin to remove it from the Plugin field.

*** ## Additional Options Here you can set the alert severity and configure additional options. The following options are available:

Option	Description
Urgency	Select the category to which the alert should be assigned. The default urgency is Warning. Click the Urgency field to expand a list of all available options, then select an Alert category. The following options are available: Information: If there are open Issues triggered by the corresponding Alert, a notification is sent monthly. Warning: If there are open Issues triggered by the corresponding Alert, a notification is sent weekly. Critical: If there are open Issues triggered by the corresponding Alert, a notification is sent daily.
Notify if Alert was Resolved	Allow a notification to be sent when the Alert is resolved. Please note: This does not apply to incidents, meaning one-time events that remain open until they are manually marked as reviewed. Enable the toggle next to Notify if Alert was Resolved to enable this option.
Alert Active	Enable the Alert so that it can trigger notifications and, optionally, perform additional actions. This option is enabled by default. Enable the toggle next to Alert Active to enable this option.
Inform Responsible Persons	Allow responsible users defined, for example, in the host or endpoint settings to be notified even if they have not been explicitly configured as recipients. This option is enabled by default. Enable the toggle next to Inform Responsible Persons to enable this option.

*** ## Further Resources **Knowledge Base** * [Welche spezifischen Alarme kann ich in Enginsight definieren?](https://docs.enginsight.com/docs/knowledge-base/alarme/welche-spezifischen-alarme-kann-ich-in-enginsight-definieren) * [Wie konfiguriere ich in Enginsight den Versand von SMS-Benachrichtigungen bei Alarmen?](https://docs.enginsight.com/docs/knowledge-base/alarme/wie-konfiguriere-ich-in-enginsight-den-versand-von-sms-benachrichtigungen-bei-alarmen)