Review and replay signals
See every signal that reached a source, check whether a rule matched it, and run it through the rules again after you fix a rule.
In the sidebar, open Critical Alerts, then Signals. The page address is /critical-alerts/signals.
A signal is one message that reached a source. This list is the first place to look when a device fired but nobody was called: it shows whether the signal arrived at all, and whether any rule matched it.
Before you start
- Your admin has to give your role permission to view critical alerts. Replaying a signal needs the separate replay permission.
Steps
- Use the Filters button to narrow by Signal type (Open, Clear, Heartbeat or synthetic test signals) and Status (accepted, unmatched, ignored, resolved, grouped, suppressed or dead lettered).
- Type in the search box to match a title, summary or source.
- Press Open on a row to see Signal detail: everything Nova recorded for that signal, including the details the outside system sent.
- Fix the rule that should have matched and publish it, then come back and press Replay on the signal. Nova runs it through the rules again as if it had just arrived.
What you see
- Each row shows the signal's title, where it came from, its summary, when it occurred, when Nova processed it, and two badges: its status and its type.
- Replay confirms with "Signal replayed." A match opens an incident exactly as a live signal would.
- The list is paged; the count at the bottom is the true total, not only the rows on screen.
If something looks different
- The signal is not in the list at all: it never reached Nova. Check the address in the outside system; see Add a source and send it a signal.
- Status is unmatched: no published rule matched it. Compare the signal's event name and type with the rule's match fields.
- Status is suppressed: a suppression window covered it. See End, disable or archive a suppression window.
- Signal detail looks like raw code: that is how it shows today, every recorded field, unformatted. Scroll for
event_name,severityandtitle.