Managing alert incidents

Overview

Alert incidents give you a centralized view of every query alert that Business Activity Monitoring (BAM) has generated for a Pull Model business process. From the Incidents tab under Monitoring, you can review alert details, manage incident states, investigate notification delivery, and export a PDF report — all without leaving the monitoring section.

Business value

Alert incidents reduce the time it takes to diagnose notification gaps, triage query monitoring violations, and audit alert activity across Pull Model business processes. The state lifecycle — from open through acknowledgement to close — provides accountability and a clear audit trail of who acted on an alert and when. Instead of checking external notification channels individually, you can review all query alerts, their delivery status, and the linked saved queries that triggered them in one place.

How it works

When a Pull Model query monitor detects a threshold violation, BAM creates an alert incident. Incidents appear in the Incidents tab under Monitoring for the relevant business process. The list shows each incident's status, alert type, issue count, and creation time.

Each incident supports four states:

• Open — a threshold violation has been detected and is unaddressed.
• Acknowledge — the incident has been noted and is under investigation. Acknowledging an incident also stops any active escalation policy sequence.
• Close — the violation is resolved and the incident is no longer active.
• Reopen — the incident requires further attention after being closed.

State changes can be applied to a single incident via the Actions menu (⋮), or to multiple incidents simultaneously using the Actions dropdown after selecting the relevant incidents.

Each entry in the incident list captures the alert type (Query alert), the number of issues, and the creation timestamp. Clicking the status link on an incident opens the Alert details panel, which shows the saved query name, the query expression, and the number of instances matched during the evaluation window. Selecting View notification details from the Actions menu (⋮) shows the per-channel delivery status and escalation rule level.

Steps

Use the following steps to manage alert incidents for a Pull Model business process. Navigate to Business Activity Monitoring > your business process > Monitoring > Incidents to get started.

Change an incident state

Changing an incident state moves it through the triage lifecycle and, when acknowledged, halts any active escalation sequence.

1. In the Incidents list, locate the incident you want to update.
2. Click the Actions menu (⋮) next to the incident.
3. Select the target state: Acknowledge, Close, or Reopen.

To update multiple incidents at once:

1. Select the checkboxes next to the incidents you want to update.
2. Click the Actions dropdown at the top of the list.
3. Select the target state.

View alert details

Viewing alert details lets you inspect the saved query and the conditions that triggered a specific query alert.

1. In the Incidents list, locate the incident you want to review.
2. Click the Status link (for example, Open) on the incident row.
3. Review the Alert details panel, which shows:
   • The business process name.
   • Each saved query that contributed to the alert, including the query expression and the number of instances matched within the evaluation window.

View notification details

Viewing notification details lets you confirm which channels received the alert, check delivery timestamps, and investigate any escalation or delivery failures.

1. In the Incidents list, locate the incident you want to inspect.
2. Click the Actions menu (⋮) next to the incident.
3. Select View notification details.
4. In the Notification details panel, review the following:
   • Escalation rule level — the escalation level at which this notification was sent.
   • Current iteration — the repeat count for the escalation sequence.
   • Transmitted at — the timestamp of the notification.
   • Per-channel list — each configured channel is listed with its name and transmission timestamp. Channels with delivery failures display an error indicator.
5. Enable View details of all levels to see notification history across all escalation rule levels for this incident.

View user action history

Viewing user actions lets you audit every state change made on an incident, including who acted and when.

1. In the Incidents list, locate the incident you want to audit.
2. Click the Actions menu (⋮) next to the incident.
3. Select View user actions.
4. Review the action history, which includes the user's name, the timestamp, and the state change applied.

Filter incidents

Filtering narrows the incident list so you can focus on a relevant state or time period.

1. In the Incidents list, use the filter controls at the top of the list.
2. Apply one or more of the following filters:
   • Incident status — show only Open, Acknowledged, or Closed incidents.
   • Date — restrict results to a specific date range.
3. The list updates to show matching incidents.

Export alert history

Exporting generates a PDF report of transmitted alerts for a selected date range and delivers it to a notification channel.

1. In the Monitoring section, click the download icon.
2. Select a Date range covering the alerts you want to export.
3. Select one or more Notification channels to receive the report.
4. Click Export.

Limitations

• Alert incidents in the Pull Model are generated only by query monitor violations. Duration, exception, and summary monitor types are not available in the Pull Model.
• Escalation policy acknowledgement applies to the incident as a whole. If multiple queries contributed to a single incident, acknowledging the incident stops escalation for all of them.
• [MISSING INFORMATION: confirm whether bulk state changes support all states (Acknowledge, Close, Reopen) or a subset]

Troubleshooting

1. Incident state cannot be changed
   Cause: The incident is already in a terminal state (Closed), or the user does not have the required permissions to update incident states.
   Fix: Confirm the incident state and your role permissions. If the incident needs to be reopened, select Reopen from the Actions menu (⋮).

2. Escalation policy does not stop after acknowledging an incident
   Cause: The acknowledgement was applied to the wrong incident, or the escalation sequence had already advanced before the acknowledgement was saved.
   Fix: Verify that the correct incident is in the Acknowledge state. If escalation continues, check whether additional open incidents exist for the same query monitor.

3. Notification details shows no delivery records
   Cause: The notification channel was not configured at the time the alert was generated, or the channel was deleted after the alert fired.
   Fix: Review the notification channel configuration in the query monitor settings and ensure at least one active channel is assigned.

4. Bulk state change applies to unintended incidents
   Cause: Additional incidents were selected inadvertently before clicking the Actions dropdown.
   Fix: Deselect all incidents and re-select only the intended ones before applying the bulk state change.

5. Incidents tab shows no alerts despite an active query monitor
   Cause: No query threshold conditions have been met within the current view period, or the query monitor was recently configured and has not yet triggered.
   Fix: Confirm the query monitor is enabled and that the configured thresholds match the expected query result volume. Check whether the saved query returns results in the Tracking section.

Related articles

• Query monitoring
• Managing escalation policies
• Querying transaction instances