Check why a signal did or did not match a rule

Open one signal to see exactly what the device sent, which rules Nova checked it against and which match field failed, then fix the rule.

In the sidebar, open Critical Alerts, then Signals, and press Open on the signal's row (or click the row). The page address is /critical-alerts/signals/ followed by the signal.

The signal opens as Signal detail, a panel over the signals list. Close it to go back to the list. The panel has no buttons: it shows everything Nova recorded about the signal as raw text, one detail per line, with the detail's name before the colon. This article tells you which lines to read.

Before you start

• Your admin has to give your role permission to view critical alerts. Fixing the rule afterwards needs permission to manage rules.
• If the signal is not in the list at all, it never reached Nova. See Add a source and send it a signal.

Steps

1. Open the signal and find status near the top. It says what happened to the signal (see below).
2. Read event_name, signal_type, severity and title. That is what the device sent, as Nova read it.
3. Scroll to matched_rules. There is one block per published rule Nova checked, in evaluation order, each named by the rule's Key on the rule_key line. Nova stops at the first rule that matches, so when a rule matched, it is the last block.
4. In the block for the rule you expected, check source_bound. false means the rule listens to a different source.
5. Under results, read each comparison: field is what was compared, expected is what the rule wants, actual is what the signal carried, and matched is true or false.
6. Open Rules, press Edit on that rule, and change Match event name, Match signal type or Match title contains to what the signal actually carried.
7. Save the rule, then press Publish on its row. Only published rules are checked.
8. Go back to Signals and press Replay on the signal. Nova runs it through the rules again; see Review and replay signals.

What you see

What status means:

• unmatched: no published rule matched. matched_rules shows why each one failed.
• open: it matched a rule and opened a new incident.
• suppressed: it opened an incident, but a suppression window held back the calls and messages.
• grouped: it matched and joined an incident that was already open.
• resolved: a clear signal closed the open incident.
• ignored: a clear signal arrived, but there was no open incident to close.

Other useful lines:

• context, inside each rule's block, lists the values Nova compared. The event name, signal type and severity are shown in lower case.
• payload_json is what the outside system sent, exactly as it arrived; normalized_payload_json is what Nova read from it.
• occurred_at and processed_at are when the signal happened and when Nova handled it.

If something looks different

• matched_rules is empty: no rule was published when the signal arrived. Draft rules are never checked; see Publish a draft or roll back to an earlier version.
• actual and expected differ only in capital letters: that is not the cause, because Nova ignores capital letters. Look for a spelling difference, a space or an underscore.
• The wrong rule matched: a rule earlier in the order matched first. Put the more specific rule higher with Manage evaluation order on Rules.
• Nova says "Signal doesn't exist." and shows the signals list: Nova cannot find that signal in the organization you are signed in to.
• The panel does not link to the incident or rule. Find the incident by its title under Incidents, and the rule by its key under Rules.

Open Signals