> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts.md).
# Working with Alerts
Alerts are critical enablers in the proactive journey of IT support teams. They allow teams to detect issues and help them prioritize their efforts to improve the digital employee experience (DEX).
***
## What are monitors and alerts?
A **monitor** is a rule that you configure to regularly evaluate metrics against defined conditions or performance metrics, such as system crashes, load times, or failed connections.
* Monitors trigger an alert when the defined conditions are met.
* Monitors can be custom-created or built-in (system monitors or installed from Nexthink Library).
An **alert** is therefore the result of a monitor detecting issues or anomalies in your IT environment.
* Triggered alerts are visible in the timeline on the [Alerts overview](/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts/responding-to-alerts/alerts-overview.md).
* If configured, triggered alerts activate emails or webhook notifications to communicate issues within your organization.
* An alert stays open until metric values stabilize and a subsequent evaluation closes it.
{% hint style="info" %}
Explore the [Alerts FAQ](/platform/user-guide/alerts-and-diagnostics/alerts-faq.md#how-does-the-system-determine-when-to-close-alerts) to learn more about alert opening and closing logic.
In addition, refer to the [Managing Alerts](/platform/user-guide/alerts-and-diagnostics/setting-up-and-managing-monitors/managing-alerts.md) documentation to learn about setting up and customizing monitors.
{% endhint %}
## How do alerts detect issues and help me diagnose them?
Alerts notify you about issues that require swift action and actual user intervention—situations where something changed or occurred unexpectedly.
Alerts issue-detection enables you to adjust the detection granularity and determine the affected users/devices, from a single disruption to widespread incidents:
Detect global issues impacting your environment
Detect issues Nexthink identifies based on the cross-organization statistics that impact your environment with Alerts **cloud insights:**
* Learn about binary reliability and performance, and detect anomalies such as abnormal CPU usage.
* Quickly identify impacted binary versions and find the recommended version.
{% hint style="info" %}
Refer to the [Alerts overview](/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts/responding-to-alerts/alerts-overview.md) to learn how to monitor and use alerts for diagnostic purposes.
{% endhint %}
Detect frequent issues across devices
Monitor the values of any metric across multiple devices to detect whether an aggregated metric value has breached the defined threshold, or shifts by a specific percentage.
For example, the system triggers an alert when the number of crashes of any binary increases by 100% in relation to a predefined norm, like the average of a metric value over the last 7 days.
Refer to the [Detecting issues impacting multiple devices](/platform/user-guide/alerts-and-diagnostics/setting-up-and-managing-monitors/creating-custom-monitors/detecting-issues-impacting-multiple-devices.md) for more information.
Detect a specific endpoint device, mobile device, or user with issues
Monitor issues on a single device or for a specific user to subsequently trigger alerts if applicable. Send separate notifications for each device or user.
For example, the system triggers an alert for each device that had at least 2 system crashes within the last 24 hours and creates a ticket in the ITSM software on behalf of the user.
Refer to the [Detecting issues impacting a single device or user](https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/managing-alerts/creating-custom-monitors/detecting-issues-impacting-a-single-device-or-user) documentation for more information.
Detect the number of endpoint devices, mobile devices, or users with issues
Detect whether a certain number of devices or users experienced an issue.
For example, the system triggers an alert when more than 20 devices had a boot time of over 60 seconds, within the past 24 hours.
{% hint style="info" %}
Explore the [Alerts FAQ ](/platform/user-guide/alerts-and-diagnostics/alerts-faq.md#how-can-i-investigate-and-query-devices-associated-with-an-existing-alert)to learn how to investigate devices—including mobile—associated with an existing alert, using NQL queries.
{% endhint %}
## How does the system trigger and close an alert?
Nexthink monitors trigger alerts by regularly evaluating metrics against defined conditions or performance metrics.
This continuous evaluation can be scheduled for regular intervals or configured for real-time monitoring to detect issues instantly, indicating how long a threshold is breached.
Regardless of the trigger method, the monitor determines whether to open a new alert, keep the current alert **Open**, or close it.
An alert stays open until metric values stabilize and a subsequent evaluation closes it.
{% hint style="info" %}
Explore the [Alerts FAQ](/platform/user-guide/alerts-and-diagnostics/alerts-faq.md#how-does-the-system-determine-when-to-close-alerts) to learn more about alert opening and closing logic.
{% endhint %}
## Are there monitors I can use out of the box?
When you open Nexthink Alerts and Diagnostic for the first time, the system activates built-in monitors by default to track your IT environment for the most common issues. You can tailor these monitors to your preferences.
{% hint style="info" %}
Refer to:
* [Customizing built-in monitors](/platform/user-guide/alerts-and-diagnostics/setting-up-and-managing-monitors/customizing-built-in-monitors.md) for more configuration information
* [Setting up and managing monitors](/platform/user-guide/alerts-and-diagnostics/setting-up-and-managing-monitors.md#system-and-nexthink-library-monitors) for available system monitors.
{% endhint %}
***
RELATED TOPIC
* [Responding to Alerts](/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts/responding-to-alerts.md)
* [Managing Alerts](/platform/user-guide/alerts-and-diagnostics/setting-up-and-managing-monitors/managing-alerts.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
