Insight ID monitored by this alert. Note: Response returns full InsightBasicSerializer object.

Short ID of the insight monitored by this alert.

Display name of the insight monitored by this alert.

Whether this alert can use the AI detector, judged for the person who created it, since scheduled checks run as the creator. Only computed when retrieving a single alert; null elsewhere.

Human-readable name for the alert.

Current alert state: Firing, Not firing, Errored, or Snoozed.

Whether the alert is actively being evaluated.

Local time that starts alert checks in HH:MM format. Updating this value recalculates the next check. Set null to remove the custom start time.

Total alert checks matching the retrieve filters (date window). Only set on alert retrieve; omitted otherwise.

Skip this many completed insight intervals after excluding the ongoing interval (0-100, default 0). Time-series Trends only. A positive delay requires check_ongoing_interval=false. Uses the insight interval, not the check frequency. Allows late data to arrive, but also delays detection of real problems.

• real_time - real_time
• every_15_minutes - every_15_minutes
• hourly - hourly
• daily - daily
• weekly - weekly
• monthly - monthly

Snooze the alert until this time. Pass a relative date string (e.g. '2h', '1d') or null to unsnooze.

Skip alert evaluation on weekends (Saturday and Sunday, local to project timezone).

The last calculated value from the most recent alert check.

When enabled, an investigation agent runs on each check where the alert fires, up to three times per firing episode, and writes findings to a Notebook linked from the alert check. An episode is the run of consecutive firing checks since the last check that did not fire. A later investigation of the same episode that reaches a different verdict sends one follow-up notification, unless investigation_inconclusive_action suppresses it. Only effective for detector-based (anomaly) alerts.

When enabled (and investigation_agent_enabled is on), the first fire of an episode is held until the investigation agent produces a verdict, and that notification is suppressed when the verdict is false_positive (and optionally when inconclusive). Later fires of the same episode notify without waiting. A safety-net task force-fires after a few minutes if the investigation stalls.

• notify - Notify
• suppress - Suppress

Insight ID monitored by this alert. Note: Response returns full InsightBasicSerializer object.

Short ID of the insight monitored by this alert.

Display name of the insight monitored by this alert.

Whether this alert can use the AI detector, judged for the person who created it, since scheduled checks run as the creator. Only computed when retrieving a single alert; null elsewhere.

Human-readable name for the alert.

Current alert state: Firing, Not firing, Errored, or Snoozed.

Whether the alert is actively being evaluated.

Local time that starts alert checks in HH:MM format. Updating this value recalculates the next check. Set null to remove the custom start time.

Total alert checks matching the retrieve filters (date window). Only set on alert retrieve; omitted otherwise.

Skip this many completed insight intervals after excluding the ongoing interval (0-100, default 0). Time-series Trends only. A positive delay requires check_ongoing_interval=false. Uses the insight interval, not the check frequency. Allows late data to arrive, but also delays detection of real problems.

• real_time - real_time
• every_15_minutes - every_15_minutes
• hourly - hourly
• daily - daily
• weekly - weekly
• monthly - monthly

Snooze the alert until this time. Pass a relative date string (e.g. '2h', '1d') or null to unsnooze.

Skip alert evaluation on weekends (Saturday and Sunday, local to project timezone).

The last calculated value from the most recent alert check.

When enabled, an investigation agent runs on each check where the alert fires, up to three times per firing episode, and writes findings to a Notebook linked from the alert check. An episode is the run of consecutive firing checks since the last check that did not fire. A later investigation of the same episode that reaches a different verdict sends one follow-up notification, unless investigation_inconclusive_action suppresses it. Only effective for detector-based (anomaly) alerts.

When enabled (and investigation_agent_enabled is on), the first fire of an episode is held until the investigation agent produces a verdict, and that notification is suppressed when the verdict is false_positive (and optionally when inconclusive). Later fires of the same episode notify without waiting. A safety-net task force-fires after a few minutes if the investigation stalls.

• notify - Notify
• suppress - Suppress