Getting Started with Alerts

The Alerts module lets your security alerts flow automatically into your PSA as tickets. When something happens on a protected device, an alert is raised and, based on the rules you set up, a ticket is created in your PSA for your team to action. No more watching a separate console or copying details across by hand.

This guide walks you through turning the module on, building your first rules, testing them, and understanding what you will see once alerts start arriving. You read this as the person managing the integration inside your PSA.

Before you begin

A few things need to be in place before alerts will work:

• An existing integration. Alerts is added on top of your existing PSA integration. If you have already set up billing reconciliation, you are most of the way there. If you have not connected a PSA yet, start with the Quick Start Guide first.
• The right PSA permissions. The integration needs permission to read your agreements and to create, update, and close tickets in your PSA. Follow the permission setup guide for your PSA before continuing: ConnectWise, HaloPSA, Autotask, Syncro, or Kaseya BMS.
• Alerts enabled for your account. Alerts is rolling out in stages. Once it has been switched on for your account, the steps below become available. If you do not see the option to add the module, reach out to support and ask to have Alerts enabled.
• The board or queue the ticket is created on
• The ticket type, subtype, and item
• The status and priority
• The alert type the rule applies to (for example, a security focused rule)
• Received the alert
• Confirmed the account exists and selected it
• Matched it to a rule
• Created the ticket in your PSA

Good to know You do not need to map services or configuration items for alerts to work. Mapping is only required for billing reconciliation.

Step 1: Turn on the Alert to Ticket module

1. Open the application and go to Integrations. You will see your existing integration listed here.
2. Go to Modules. Your billing integration shows up as the Contract Agreement module.
3. Find Alert to Ticket and click to turn it on, then click Save.
4. That is it. The module is switched on automatically as soon as it is added, and a new Alerts page appears. You do not need to refresh, clear your cache, or do anything else for it to show up.

Modules — Alert to Ticket toggled on

 

Tip If a teammate has just had Alerts enabled, they only need to reload the page they are on. There is nothing else to switch on.

Step 2: Build your rules

Rules decide what happens to an incoming alert: which PSA board it lands on, what type of ticket it becomes, what priority it gets, and so on. You build them on the Alerts page.

The default rule

Your first rule is the default rule, and it is already there for you. Think of it as a catch all: if an incoming alert does not match any other rule you have created, the default rule handles it. Because of that, the default rule covers every alert type and you cannot narrow it down. If you try to limit it to a single alert type, the system will not let you save the change. That is by design, so nothing ever slips through with no rule to catch it.

For a lot of teams, the default rule on its own is enough to get going. You can always add more later.

Adding your own rules

To route specific kinds of alerts differently, create additional rules. For each rule you choose where the ticket should go in your PSA and how it should look. The exact fields depend on your PSA, but they generally include things like:

These options are pulled live from your PSA, so what you see reflects how your own PSA is set up. More on that below.

Heads up on product groups In the Alerts module, product group refers to the affected product line. For SonicWall that is Firewalls or Capture Client. This is separate from any “product group” concept inside your own PSA, so it is worth keeping the two straight when you build rules.

 

The rule builder — board, type, priority, and alert type

Step 3: Test your rules

Every rule has a Test Alert button. Click it and the integration sends a real test alert through the rule and into your PSA, exactly as a live alert would arrive. It is the fastest way to confirm a rule is wired up correctly before you rely on it.

Where to look for test tickets Test alerts do not appear in the audit trail inside the app. To confirm a test worked, open your PSA and look for the freshly created test ticket there.

What happens when an alert comes in

Once your rules are live, alerts start creating tickets on their own. Here is what that looks like from both sides.

In your PSA

The integration creates a clean, templated ticket. It tells you the vendor, notes that it was generated by the integration, names the affected product group (Firewalls or Capture Client), stamps the time, and includes the alert details. The details section is the part that changes from alert to alert; the rest is a consistent template so your team always knows what they are looking at.

A ticket created in the PSA from an alert

On the Alerts page

Back in the app, the Alert to Ticket page lists each alert with its status, timestamps, the account it was raised for, and the matching ticket ID in your PSA. Click into an alert to open its audit trail, which is a plain step by step of what the integration did:

If something goes wrong, the audit trail is the first place to look. Errors show up at the end of the trail.

The yellow “Suppressed” state Now and then an alert will show as Suppressed in yellow rather than creating a ticket. This usually means there was no rule set up to match it, or the alert referenced something your PSA is not configured for. If you were expecting a ticket and did not get one, check that a rule covers that alert.

Smart Append and Smart Resolve

Two rule settings control how follow up activity on an alert is handled. They are genuinely useful, but they are also the settings people most often get caught out by, so it is worth understanding them before you flip them on.

Smart Append

When an alert is created it gets an ID that follows that alert through its lifecycle. If a follow up comes in for the same alert and the rule is set to append, the update is added to the existing ticket as a note rather than spawning a new one. You will see the new activity attached to the original ticket.

The append gotcha If the rule is set to create a new ticket instead of append, then updates will always create a brand new ticket. There is no appending in that mode, ever. If you expected updates to land on the original ticket and they are not, this setting is the first thing to check.

Smart Resolve

With Smart Resolve turned on for a rule, when the source reports that an alert has been handled, the integration acts on it for you: it either notes that the alert was marked resolved, or, if you have set a resolution status, it moves the ticket to that status, for example closing it. A closed ticket then drops off your active board as you would expect.

The resolve gotcha If Smart Resolve is turned off and an alert has been reported as handled but the ticket is still sitting open, that is almost certainly why. Turn the setting on for the rule if you want tickets to close automatically.

Turning rules on and off

Each rule can be enabled or disabled, and the module itself can be turned off. This is handy, but it is also a common reason an expected ticket never appears. If a rule you were relying on did not fire, check that the rule and the module are both switched on before digging further.

A note on your PSA setup

How your alerts turn into tickets depends heavily on how your PSA is configured: your boards, statuses, ticket types, priorities, and how they relate to one another. ConnectWise in particular is hierarchical, so a board drives which statuses and types are available, and changing one can change the others. Other PSAs such as Syncro, Pulseway, and HaloPSA are simpler and may not have all of these concepts.

The Alerts module reflects whatever your PSA exposes, so if a field looks empty or an option is missing, it usually points back to how that area is set up on your side. Getting your boards, statuses, and types in order before building rules will save you time.

Need a hand?

If you get stuck, reach out through the Customer Portal. Have your PSA name and, where you can, the alert or ticket ID ready so we can trace it quickly through the audit trail.