Investigate a fired log-based alert

Review a fired alert and load its relevant log events when you have access to the underlying data.

You need permission to view the detector. Access to the fired alert does not grant access to the underlying log data.

  1. Go to Alerts > Active alerts.
  2. Select log from Type.
  3. Select a recent firing.
  4. If you have access to the underlying logs, run the read-only SPL search to load relevant events.
  5. Review its criticality, trigger count, most recent firing time, timeline, and message.
  6. Open the detector configuration or open the search in Log Observer when you have the required permissions.

If you do not have log access, permitted alert metadata remains available, but raw-log actions are unavailable.