Review critical alert analytics

See how many incidents sit in each status and which sources fire most over the last 7 days.

In the sidebar, open Critical Alerts, then Analytics. The page address is /critical-alerts/analytics.

This page is a quick read on the last 7 days, the same window behind the Signals / 7d count on the dashboard.

Before you start

• Your admin has to give your role permission to view critical alert analytics, and analytics has to be included in your organization's plan.

Steps

1. Open the page. There is nothing to set; both panels load for the last 7 days.
2. Read Incidents by status to see how many incidents are open, acknowledged, escalated, suppressed or resolved.
3. Read Top sources to see which sources sent the most signals.
4. Act on what you see. A source at the top of the list with a pile of open incidents is a candidate for the Flapping / noisy sensor preset on its rule, or for a suppression window while it is repaired.

What you see

• Incidents by status: one line per status with a count.
• Top sources: one line per source with its signal count, highest first.
• There is no date picker or export on this page. For a downloadable history, use Audit; see Review and export the audit history.

If something looks different

• Both panels are empty: no signals arrived in the last 7 days.
• The page says you do not have access: your role lacks the analytics permission, or your plan does not include it. Ask your admin.

Open Analytics