FAQ
Top questions from MSPs about AlertFlow setup, alerting, and on-call management.
›Can I send alerts from multiple RMM tools to one AlertFlow org?
Yes. Create a separate Integration in AlertFlow for each tool. Each integration gets its own unique ingest token and field mappings, so Kaseya VSA and ConnectWise alerts can land in the same dashboard, properly labeled with their source.
You can also assign each integration to a specific Client — this means every alert from that integration automatically carries the client name, even if the payload doesn't include one.
›How does deduplication work? Will I get spammed if an alert fires repeatedly?
AlertFlow deduplicates by fingerprint — a hash of the alert title, source, and your organization. If the same alert fires again while the original is still firing, the dedupCount counter increments instead of creating a new alert. You get one alert row, not thousands.
You can set an explicit fingerprint or dedup_key in the payload to control dedup behavior — useful when your tool fires alerts with slightly different titles for the same underlying issue.
›What happens if the on-call engineer doesn't respond to an SMS?
AlertFlow doesn't retry just because someone didn't reply — that's what your escalation workflow is for. Use a Delay node (e.g., 5 minutes) followed by a Condition checking Alert Status = firing, then add a second Notify targeting the secondary on-call or a voice call.
See the Escalation Patterns guide for ready-made workflow recipes.
›Can I auto-create tickets in ConnectWise or Kaseya for every alert?
Yes. Add a Create Ticket node to any workflow and connect it immediately after the trigger (or after a severity condition). The ticket is created in your PSA with the alert title, description, and any custom template variables you configure.
Supported ticket systems: ConnectWise Manage and Kaseya VSA. For other PSAs (Autotask/Datto PSA, Syncro), use an HTTP Request node to call the PSA API directly.
›How do I prevent alert noise during a maintenance window?
Use a Suppression Window (Settings → Suppression). Set the time range and match conditions (e.g., label env = staging or label client = Acme Corp). While the window is active, matching alerts are suppressed — they're still logged, but no workflow fires and no notifications are sent.
For recurring maintenance (e.g., every Tuesday from 2 AM to 4 AM for patching), set the window to Recurring with a cron schedule.
›What's the difference between an alert and an incident?
An alert is a single event from a monitoring tool: "High CPU on WEB-01." An incident is AlertFlow's grouping of related firing alerts into one case. When the first alert for a fingerprint fires, an incident is opened. As more alerts fire with the same root cause (same client, same time window), they're grouped into that incident.
You acknowledge and resolve the incident, which propagates to all linked alerts. Workflows can trigger on both alert events and incident events.
›Can I use AlertFlow's API to push alerts from my own scripts?
Yes — that's what the Ingest Webhook is for. Create a Generic Webhook integration, grab the ingest URL, and POST JSON from any script, cron job, or application. There's no separate API key needed — the ingest token in the URL is the authentication.
For reading alert data (building custom dashboards, exporting to a data warehouse), use the v1 REST API with a Bearer API key.
›How do I route alerts for different clients to different Slack channels?
Use a workflow with Condition nodes that check Label "client" = "Acme Corp" and route each client's alerts to their own channel. You can have multiple condition branches in a single workflow, or create separate workflows per client.
If you have many clients, consider using the Label field with in list operator to group clients by tier and route them together.
›Does AlertFlow work with Grafana or Prometheus?
Yes — both are natively supported. For Grafana, configure a webhook contact point in Grafana → Alerting → Contact Points pointing to your AlertFlow ingest URL. AlertFlow understands Grafana's native payload format automatically.
For Prometheus Alertmanager, add a webhook_configs receiver pointing to the AlertFlow ingest URL. The Prometheus integration handles alertname, severity, instance, and label forwarding natively.
›How do on-call schedule handoffs work? What if no one is on-call?
AlertFlow resolves the on-call engineer at the time the workflow step executes, not when the workflow was created. This means if an incident starts during one engineer's shift and escalates into the next shift, the escalation SMS goes to the new on-call engineer.
If no engineer is on-call at execution time (schedule gap), AlertFlow logs the notification as no on-call engineer found and continues to the next workflow step. Prevent this by adding a backup layer to your schedule — a senior engineer or manager who always covers gaps.