Alert
Opens from the agent name on an alert row in the Reliability Alerts tab, and from every alert notification. It is where an alert lands: the rule, who it notifies, the latest first-pass investigation, and the fire history. Edit a rule from its row on the Alerts tab.
What you see
Alert rule
A panel with what the rule fires on (the same wording as the Alerts table, for example
20% failure rate or anomaly · medium), its quiet period, whether it is on, and Notifies:
who the rule reaches at its severity, for example “Critical → Email (3 people), Slack (1 person)”.
For an anomaly-mode alert there is no fixed line: the rule
compares the agent with its own last 7 days. A switch on this panel turns the Investigator on or off
for this rule only.
The alert is fetched by id. An alert from another workspace (for example a real-workspace notification opened while viewing demo data) shows “Alert not found” with the reason.
Investigation hypothesis
Below the rule panel, the latest Investigator run for this alert: a first-pass hypothesis with evidence, never a confirmed cause. Each evidence line links to what it cites (the trace, or the alert), and the cited traces are listed. If the Investigator is off for this rule, its last run still shows, with a note that no new runs will start.
The confidence and review state come from the run itself, so this page and the Investigations queue always agree.
A run that needs review leads with its review label, for example “Needs review · Medium confidence”, and with “Leading hypothesis (medium confidence): … Verify before acting.”, with all evidence expanded.
Fire history
The rule’s last 10 firings. Each says what was observed against the threshold or against what is usual for this agent, for example “40% failure rate (last 10 labeled runs)” against “threshold 20% failure rate”, and links to the traces in the window that fired it.
Each firing also has an incident action, and the latest one is repeated at the top of the page next to Open in Investigations:
- Open incident records an incident for that firing, after you confirm. It starts Open, takes its severity from the rule (critical → Critical, warning → Medium, info → Low), starts when the alert fired and links to this alert and its agent. Nobody is notified: an incident doesn’t page anyone. Pages come from the alert itself.
- Add to open incident appears instead when this rule already has an open or investigating incident. It adds the firing to that incident and leaves its status and severity as they are.
- View incident appears once the firing belongs to an incident.
Morse never opens an incident on its own. Owners, admins and members can use these actions; viewers see why they can’t, and demo data is read-only.
How to use it
- Read the rule panel to confirm what’s being watched and at what threshold.
- Expand the evidence list on a confident hypothesis to see what Investigator correlated; a low-confidence run shows all evidence already expanded.
- Follow Back to alerts to return to the Alerts tab — there’s no edit or delete control on this page itself; those live in the alerts table.
Before you have data
If Investigator hasn’t run yet for this alert (or a run is in flight), the card shows an “Investigating…” placeholder instead of an empty hypothesis.
If Investigator is disabled for this alert, the hypothesis card isn’t shown at all — there’s no placeholder state for “disabled.”
Related
- Reliability — the Alerts tab this page opens from.
- Incident — an incident’s timeline can link back to the alert that triggered it.