Alerts

An alert is GreenSlope telling you "a human should look at this now or soon". This page covers the alert types, how routing works, and how alerts relate to the in-product Doctor page.

Alert types

GreenSlope fires three alert kinds:

• Burn-rate alerts — the SLO is in trouble. See SLOs and burn rates for the multi-window definition.
• Regression alerts — a recent release is worse than the previous one on at least one SLO. Fires within the change-event window.
• Hard-failure alerts — the service is effectively down: heartbeats missing, error rate >50% for over two minutes. Paged at sev-1 regardless of SLO.

Every alert is a first-class object with a stable ID. It has a state (open, acknowledged, resolved), an owner (or null), and a history of what was tried.

Severity

Three severities:

• sev-1 — page someone now. SMS + voice via Twilio, plus Slack and email. Used for hard failures and page-tier burn rates.
• sev-2 — page during working hours, ticket otherwise. Slack + email.
• sev-3 — ticket only. Slack thread or email; no out-of-hours notification.

Routing, silencing, and escalation are all severity-aware. See the Slack integration for how sev-1 behaves in a channel.

Delivery channels

V1 alert channels:

The Doctor page

The Doctor page is the in-product dashboard for a service's health right now. It's different from alerts in two ways:

1. It's always visible, whether anything is on fire or not.
2. It shows derived state — "SLO burn rate over the last hour" — not just raw numbers.

When the Doctor page turns red, an alert is either already firing or about to. Every Doctor page term that can look surprising is documented in Troubleshooting — readers arriving from a confusing term should land there.

Acknowledging and silencing

Alerts can be:

• Acknowledged — a human has seen it and is working on it. Ack stops escalation but keeps the alert open.
• Resolved — the underlying signal cleared. Auto-resolves when the burn rate drops below the threshold for one short window.
• Silenced — temporarily muted for a fingerprint + duration. Use when you're knowingly shipping a change that will burn budget.

Silences are visible on the Doctor page as an amber banner — nothing is silently silenced. If a silence expires with the underlying signal still bad, the alert re-fires.

Routing rules

Routing rules decide which channel (and which team) receives an alert. Rules match on tags like service, environment, severity, and on label sets derived from spans. First match wins.

A typical rule set:

severity = sev1                       → #incidents  + Twilio SMS to oncall
service = billing                     → #billing-oncall
environment = staging                 → #staging-noise (no paging)
service = web   AND  environment=prod → #web-oncall
fallback                              → #oncall

Configure routes in the dashboard at Settings → Alerts → Routes.