AlertFlow
Browse docs
AlertFlow DocumentationQuickstartIntegrations OverviewGeneric WebhookKaseya VSAConnectWise ManageN-ableSolarWindsDattoWorkflow BuilderBuilder TutorialCondition LogicEscalation PatternsAI AssistantNotifications OverviewChannel SetupFallback NumbersQuiet HoursOn-Call SchedulesAPI ReferenceAuthenticationList AlertsGet AlertAcknowledge AlertResolve AlertBulk AcknowledgeList IncidentsGet IncidentList ClientsCreate ClientUpdate ClientDelete ClientList WorkflowsGet WorkflowList SchedulesGet ScheduleCurrent On-CallList IntegrationsCreate IntegrationUpdate IntegrationDelete IntegrationList Suppression WindowsCreate Suppression WindowUpdate Suppression WindowDelete Suppression WindowList UsersList API KeysCreate API KeyRevoke API KeyIngest WebhookFAQ

AI Assistant

Use the AI assistant to triage alerts, generate runbooks, and surface resolution suggestions.

What the AI assistant does

AlertFlow's AI assistant is available in two places:

  1. Alert detail panel — summarize a noisy alert, suggest resolution steps, or ask questions about the alert payload
  2. Workflow builder — the AI Triage node that runs automatically as part of a workflow

The assistant is powered by Claude (Anthropic) and has access to the full alert context: title, description, labels, annotations, and recent related alerts.

AI Triage workflow node

The AI Triage node runs a prompt against the alert and stores the result as a workflow variable that downstream nodes can use.

Adding the node

  1. From the palette, drag AI Triage onto the canvas.
  2. Connect it after your initial condition (e.g., after a severity filter).
  3. In the Inspector, configure:
    • Prompt: what you want the AI to do (see prompts below)
    • Output variable: name to store the result, e.g., aiSummary
  4. In downstream Notify nodes, use {{aiSummary}} in the message template.

Example prompts

Runbook suggestion:

Given this alert, suggest 3 specific troubleshooting steps an MSP engineer should take first.
Alert title: {{alert.title}}
Description: {{alert.description}}
Host: {{alert.labels.host}}

Short summary for SMS:

Summarize this alert in 15 words or fewer for an SMS notification.
Alert: {{alert.title}} — {{alert.description}}

Severity validation:

Is the following alert actually critical, or could it be false-positive? 
Reply with just "critical", "probable_false_positive", or "uncertain".
Title: {{alert.title}}
Labels: {{alert.labels}}

Then connect a Condition node after AI Triage with:

  • Variable: aiClassification
  • Operator: equals
  • Value: probable_false_positive

And suppress the alert on the True branch.

Alert detail panel — inline AI

In the alert detail view, the AI assistant panel is available on the right side. You can:

  • Summarize — generate a human-readable summary of the raw alert payload
  • Ask — type any question: "What could cause this on a Windows Server 2019 host?"
  • Generate runbook — produce a step-by-step resolution guide that you can paste into your PSA ticket
  • Compare — paste a past alert's description and ask "is this the same root cause?"

The assistant reads the full alert context automatically — you don't need to paste it.

Privacy and data retention

  • Alert payloads sent to the AI assistant are not used for model training
  • Prompts and responses are logged for 30 days in your organization's audit log
  • You can disable the AI assistant entirely in Settings → Security → AI Features

Prompt tips

  • Be specific about the output format: "Reply with only JSON" or "Reply in one sentence"
  • Reference {{alert.labels.*}} to give the model device context it wouldn't otherwise have
  • Use a Condition node after AI Triage to gate on the AI's response — this avoids unnecessary notifications when the AI flags a false positive
  • Keep SMS prompts short: "Summarize in 15 words" produces better SMS content than a runbook

Limitations

  • AI Triage adds ~2–5 seconds of latency to the workflow execution
  • The response is always a string — use the Condition node to parse structured responses
  • AI Triage is only available on Growth plan and above
Escalation PatternsNotifications Overview