Alerts are created by Alert rules containing a set of conditions to run against the incoming agent metrics. If the Alert rule conditions are met the alert is created. Each user can optionally decide what types of alerts to receive and what method (sms or email).
RED vs AMBER Alerts
Each Alert Rule has a set of RED conditions and a set of AMBER conditions. If a RED rule condition is met, it supersedes the AMBER condition. We recommend you use RED alerts for incidents that require a clearly understood action and AMBER alerts for warnings and threshold based or performance conditions.
There are a number of alert transitions that can happen as a result of the rule. If the Alert Rule has RED and AMBER conditions based on a threshold then you might see the alert transition from GREEN to AMBER then later to RED.
You might decide that you are interested in being notified of AMBER alert by email and RED alerts by SMS as well as email, if you wish to respond to RED alerts out of hours.
Some users like to be notified when the alert condition has cleared. We call these close alerts. RED states changing to AMBER or GREEN are both close conditions for the RED alerts. Close messages for AMBER alerts indicate that the state is now GREEN.