# Alerts

Learn how PagerDuty handles alerts from events, and how to manage alerts for effective responses and noise reduction

When PagerDuty receives a qualifying event (e.g., from a monitoring tool), it triggers an alert, which then triggers an incident. You can aggregate multiple alerts into a single incident for triage, which streamlines incident handoff between teams, centralizes critical information, and reduces notification fatigue. Alerts can move from one incident to another, either [manually](/incident-management/incidents/edit-incidents#move-alerts-to-another-incident) or automatically, via [Alert Grouping](/ai-automation/aiops/overview#noise-reduction). You may also [suppress](/ai-automation/aiops/event-orchestration#incident-data) or [deduplicate](/ai-automation/aiops/event-orchestration#deduplication) alerts via [Event Orchestration](/ai-automation/aiops/event-orchestration).

## Create Alerts

> **Alert Behavior:** Similar to incidents, someone must be on-call per the service's [escalation policy](/incident-management/schedules/escalation-policies) in order to create a triggered alert. If an event with a **trigger** [event action](/developer/send-alert-event#event-action-behavior) is received but the service does not have an on-call user at that time, the event will be dropped and it will not create an alert. You cannot audit or view dropped events.

Inbound events submitted via the [Events API](/developer/events-api-v2-overview), or via Events API-based integrations, create alerts. You cannot manually create an alert in PagerDuty. 

In the most basic terms, events create alerts, and then alerts create incidents. The following diagram details this flow:

1. Monitoring tools send events to PagerDuty
2. PagerDuty triggers an alert
3. PagerDuty associates the alert with an incident
4. Incident creation sends out notifications
5. Users receive notifications

![Diagram detailing alerts' role in incident creation](/images/kb/f226d2fe5f02577508d1bc0df0502c43fc95f1a71cbbc59e9251fefe23009c40-alert_flowchart.webp)
*Alert and incident creation flow*

> **Incidents That do not Create Alerts:** Incidents created via any of the following processes do not generate alerts:
>
> - [Incidents manually triggered in the web app](/incident-management/incidents/overview#triggerdeclare-an-incident)
> - [Incidents created via REST API](/developer/incident-creation-api)
>
> With that in mind, [Event Orchestration](/ai-automation/aiops/event-orchestration), [suppression](/ai-automation/aiops/event-orchestration#incident-data) and other alert-related features are not applicable.

### Alerts and Incident Titles

When PagerDuty creates an alert, it creates an accompanying incident and gives it the same title as the alert. As time passes, it is possible that users will [manually](/incident-management/incidents/edit-incidents#move-alerts-to-another-incident) add additional alerts, or that [Alert Grouping](/ai-automation/aiops/overview#noise-reduction) will add them automatically. When this happens, the incident’s title will not change — it keeps the title from the original alert. That said, you can manually [edit an incident’s title](/incident-management/incidents/edit-incidents#edit-incident-title) at any time. You cannot edit alert titles.

## View Alerts

You can review incident-associated alerts in the PagerDuty [web app](#view-alerts-in-the-web-app) or [mobile app](#view-alerts-in-the-mobile-app). For an overview of all alerts, please refer to the [Alerts Table](/incident-management/incidents/alerts/alerts-table) article.

### View Alerts in the Web App

1. Go to **Incidents** and select an incident’s **Title** to go to its detail page.
2. Select the **Alerts** tab.
   - Here you can review information about all of the alerts grouped under the incident, as well as **Show/Hide Details** about the alert.

![A screenshot of the PagerDuty web app show an alert's details](/images/kb/c8cbdd35b2f3d5df8997d7ecc0de1f41b018c867cc7aa0316810c63e91552d44-alerts-show-details.webp)
*Show alert details*

3. Select an alert’s **Summary** for a more detailed view.
   - The **Alert Log** shows information about when the alert triggered, how it was processed, and any [deduplicated alerts](#view-deduplicated-alerts).

### View Alerts in the Mobile App

1. On the **Incidents** screen, select an incident.
2. On the incident detail screen, scroll down to the **Alerts** section and select an alert.

### View Deduplicated Alerts

While an incident is unresolved, any subsequent alerts with a matching `dedup_key` deduplicate into the original alert. 

Here is an example of the **Alert Log** showing a deduplicated alert:

![A screenshot of the PagerDuty web app showing a deduplicated alert in the Alert Log](/images/kb/37c3085f365e31822731cdf37f9bf7bce31d1c6fab62899d675cd93b83637735-alert_log.webp)
*Deduplicated alert*

For more information, please read our developer documentation [Alert Deduplication](/developer/send-alert-event#alert-de-duplication).

## Move Alerts to Another Incident

You may want to move alerts to another incident to better organize related issues or correct misclassified alerts. For example, moving alerts that were initially grouped separately but actually represent the same underlying problem, or relocating alerts that were incorrectly associated with an unrelated incident during initial triage.

### Manually Move Alerts to a New Incident

1. Navigate to the incident's details page and scroll to the **Alerts** section. 
2. Click the checkbox next to the alert you want to move. In the box that appears, select **Move** and choose **Create new incident**.
3. In the modal, the details of the new incident will populate. You can click  **Edit Incident** if you wish to change anything. Otherwise, click **Create incident**.

### Manually Move Alerts to an Existing Incident

**From the Incident Details Page**:

1. Navigate to the incident's details page and scroll to the **Alerts** section. 
2. Click into the alert's **Summary** and then click **Move to Another Incident**. 
3. Enter the existing incident's **number** and click **Find Incident**. 
4. When the incident appears, click **Move Alert**.

**From the Alerts Table**:

1. Navigate to **Incidents**  →  **Alerts**.
2. Click into the alert's **Summary** and then click **Move to Another Incident**. 
3. Enter the existing incident's **number** and click **Find Incident**. 
4. When the incident appears, click **Move Alert**.

### Alert Grouping

Please see our article on PagerDuty AIOps [Alert Grouping](/ai-automation/aiops/noise-reduction/alert-grouping) features for more information about how to aggregate alerts and reduce noise.

### Alert Suppression and Deduplication

Please see our [Event Orchestration](/ai-automation/aiops/event-orchestration) article for more information on alert [suppression](/ai-automation/aiops/event-orchestration#incident-data) and [deduplication](/ai-automation/aiops/event-orchestration#deduplication).

## Resolve Alerts

Alerts, in contrast to incidents, have two only states: **triggered** and **resolved**. You can resolve alerts manually, or via the API. If you resolve all alerts under an incident, it will resolve the incident. Conversely, if you resolve an incident, that will then resolve all alerts under that parent incident. 

> **Resolve via Events API:** When sending an event with the **resolve** [event action](/developer/send-alert-event#event-action-behavior), the event must have the same `dedup_key`as the **trigger** alert in order to resolve the alert.
>
> If a matching `dedup_key` value is not found in an existing alert, the resolve event will be dropped. You cannot audit or view dropped events.

### Resolve Alerts in the Web App

To manually resolve an alert in the web app:

1. Go to **Incidents** and select the **Title** of an unresolved incident.
2. On the incident detail page with the **Alerts** tab selected, check the box next to the alert you’d like to resolve.
   - **Note**: To mass select alerts, select the checkbox at the top in the header row.
3. Click **Resolve**.

### Resolve Alerts in the Mobile App

To manually resolve an alert in the mobile app:

1. On the **Incidents** screen, select an incident.
2. On the incident detail screen, scroll down to the **Alerts** section and select an alert.
3. Tap **Resolve**.