Monitoring, Alerts, and Investigation
What this domain tests
This domain tests how alerts are generated, routed, and investigated. You need to know alert rules, notification channels, alert states, and how investigators use RQL and asset context to triage issues.
Core rules and concepts
- Policies generate alerts; alert rules route those alerts to notification channels such as email, Slack, webhook, or ticketing integrations.
- Alert rules should be scoped by policy, severity, and account group to avoid noise.
- Alert states support triage, typically open and resolved workflows; investigation requires resource context and policy detail.
- RQL can query alerts and resources during investigation to find related assets and patterns.
- Dashboards summarize posture and workload risk, but alert rules determine who is notified.
Worked example
A team wants only high-severity production alerts in Slack. Reasoning: create an alert rule filtered to high severity and the production account group, then attach the Slack notification channel. Test the channel and verify that low-severity or non-production alerts do not route to Slack. This keeps signal high and avoids duplicate notifications.
Traps that cost marks
Do not create an alert rule without scope; it may route everything. Do not confuse a notification channel with an alert rule. Do not assume resolving an alert fixes the underlying resource. Do not skip testing integrations, because a misconfigured webhook silently drops alerts.