Alerts, on-call and escalation

Channels, who is alerted, on-call rotations, escalation policies and acknowledging incidents.

When an incident opens, its monitor’s escalation policy decides who is notified, on which channels and when. Escalation stops as soon as anyone acknowledges.

Channels

E-mail and Telegram (bot messages to a chat or group) on every plan
SMS and phone calls on every plan, within a monthly fair-use quota, sent from Heimdall’s GSM gateways
Slack and webhooks (a JSON POST signed with HMAC-SHA256) on Pro, Team and Business

Who is alerted

The people Heimdall alerts are the members of your organisation (Settings → Users). Nobody is added to a separate contact list, and each member sets their own phone number, Telegram and quiet hours in Profile → Notifications. On-call → People shows who can be reached how.

Without rules of your own there is a default, and it always applies: everybody who is alerted in the organisation gets SMS, e-mail and Telegram at once, then a phone call after 5 minutes if nobody has acknowledged. An admin can switch “is alerted” off for a member who has a login but need not be woken — an accountant, say.

A weekly on-call rotation resolves “primary” and “secondary” to real people at the moment an alert fires. Rotations and escalation policies come with Team and Business; multiple rotations need Business. A policy step that names a person reaches them whatever their “is alerted” switch says.

Escalation policies

A policy is an ordered list of steps. Each step waits for its delay, then notifies its targets on its channels.

Escalation policy

name: Production
steps:
  - after: 0m
    targets: [primary]
    channels: [sms, slack]
  - after: 5m
    targets: [primary]
    channels: [call]
  - after: 10m
    targets: [secondary]
    channels: [sms, call]
  - after: 20m
    targets: [team]
    channels: [sms, email]
repeat: 2

Acknowledge, snooze, resolve

Acknowledge stops escalation; from the dashboard, the API or by replying ACK <code> to the SMS
Snooze pauses escalation for N minutes, for example SNOOZE 482193 30
Resolve closes the incident; incidents also resolve automatically when the monitor recovers