# Prometheus Alert Manager triage Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fcases%2Fprometheus-alert-manager-triage.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fcases%2Fprometheus-alert-manager-triage.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) When a Case is opened by a Prometheus Alert Manager alert, the Case **Triage** tab shows a dedicated Prometheus Alert Manager view. Use it to see the alerts in the group, inspect their labels, annotations, and PromQL, and confirm what fired without leaving the Case. Public beta Creating and linking Cases from Prometheus Alert Manager is in public beta. ## What you need[​](#what-you-need "Direct link to What you need") * Access to Cases. * A Case opened by a Prometheus Alert Manager alert. Cases from other sources show their own triage view instead. ## Connect Prometheus Alert Manager to Cases[​](#connect-prometheus-alert-manager-to-cases "Direct link to Connect Prometheus Alert Manager to Cases") Send your Prometheus Alert Manager alerts to Coralogix to open and update Cases automatically. Alert Manager posts each alert group to a Coralogix webhook, and Coralogix opens a Case for the group, keeps it updated as alerts fire, and resolves it when the group clears. ### Before you start[​](#before-you-start "Direct link to Before you start") * An API key with the `case:Create` permission. See [API keys](https://coralogix.com/docs/docs/user-guides/account-management/api-keys/api-keys/.md) to create one. * Your Coralogix domain. See [Coralogix domain](https://coralogix.com/docs/docs/user-guides/account-management/account-settings/coralogix-domain/.md). ### Configure the webhook receiver[​](#configure-the-webhook-receiver "Direct link to Configure the webhook receiver") Add a webhook receiver to your `alertmanager.yml` that points at the Coralogix Cases webhook and authenticates with your API key: alertmanager.yml ``` global: resolve_timeout: 5m route: group_by: ['alertname', 'job'] group_wait: 30s group_interval: 5m repeat_interval: 1h receiver: 'coralogix-cases' receivers: - name: 'coralogix-cases' webhook_configs: - url: 'https://api./mgmt/v1/cases/webhooks/prometheus_alert_manager' http_config: authorization: type: Bearer credentials: '' timeout: 10s ``` Point the `url` at the Coralogix **API** domain for your region, not the web UI. It takes the form `https://api./mgmt/v1/cases/webhooks/prometheus_alert_manager`, for example `https://api.us3.coralogix.net/mgmt/v1/cases/webhooks/prometheus_alert_manager`. See [Coralogix domain](https://coralogix.com/docs/docs/user-guides/account-management/account-settings/coralogix-domain/.md) to find your domain, and replace `` with an API key that has the `case:Create` permission. Keep these webhook settings at their defaults: * `send_resolved`: leave as `true`. Coralogix needs the resolved notification to close the Case. * `max_alerts`: leave as `0`. A nonzero value truncates alerts and can leave the Case in an inconsistent state. Set `timeout` to a value such as `10s` so that a stalled connection retries in reasonable time. The default of `0s` never times out. ### How alerts map to Cases[​](#how-alerts-map-to-cases "Direct link to How alerts map to Cases") Coralogix builds each Case from the alert group's labels and annotations. Set these in your Prometheus rules: | Alert Manager field | Type | Maps to | Notes | | ------------------- | ----------- | ---------------- | ------------------------------------------------------------------------------------------------------------- | | `severity` | Label | Case priority | `critical` to P1, `error` to P2, `warning` to P3, `info` to P5. An unknown or missing value falls back to P5. | | `alertname` | Group label | Case title | Set this label. It becomes the first part of the title. | | `summary` | Annotation | Case title text | Optional. A human-readable summary. | | `description` | Annotation | Case description | Optional. | | `status` | Payload | Case state | `firing` opens or keeps the Case active, `resolved` resolves it. Always sent. | Alert Manager creates a Case per `group_by` group. Define a grouping label so that related alerts share a Case instead of opening a separate Case each. ## Open the triage view[​](#open-the-triage-view "Direct link to Open the triage view") Open the Case and select the **Triage** tab. For a Prometheus Alert Manager Case, the view lists the alert group and the alerts it contains, each with a status of **Triggered** or **Resolved**. ## Inspect an alert[​](#inspect-an-alert "Direct link to Inspect an alert") Select an alert in **Choose Alert** to inspect it: * **Labels**: the alert's label set. Labels common to the whole group are shown separately from labels specific to the selected alert. * **Annotations**: the alert's annotations. * **PromQL query**: the query behind the alert. Select **Open in Metric Explorer** to open it in Metric Explorer, where you can adjust it and explore related metrics. * **Query chart**: the alert's metric plotted over the selected range. When a section has nothing to show, for example an alert with no annotations or no PromQL, the view says so in place rather than leaving the panel blank. ## Review the alert group[​](#review-the-alert-group "Direct link to Review the alert group") The group details show the context shared across the alert group, including the group labels, common labels and annotations, the latest receiver, the group key, and the timeframe. Use this to understand what the alerts have in common before drilling into a specific one. ## Adjust the timeframe[​](#adjust-the-timeframe "Direct link to Adjust the timeframe") The view uses the Case timeframe by default. Change the window with the time picker to widen or narrow what the chart plots, and select **Reset to case timeframe** to return to the Case's own range. ## Open a Case from an Alert Manager notification[​](#open-a-case-from-an-alert-manager-notification "Direct link to Open a Case from an Alert Manager notification") Every Case opened by a Prometheus Alert Manager alert is addressable by that alert's **fingerprint** plus its start time. Point any notification that Alert Manager sends (Slack, Microsoft Teams, PagerDuty, or email) at the following URL, and responders move from the notification straight to the Case: ``` https:///#/cases?fingerprint=&start_time= ``` * ``: your Coralogix team domain, for example `team.coralogix.com`. * `fingerprint`: the Prometheus alert's fingerprint. Alert Manager assigns this stable identity to each alert, and Coralogix uses it to match the alert to its Case. * `start_time`: the alert's start time as a timestamp in the format `2026-06-17T09:30:00.000Z`. Include both parameters. Coralogix resolves the Case that matches the fingerprint and start time and opens it directly. If no Case matches yet, Coralogix returns you to the Case list and notes that the Case might not exist yet: [![The Case list with a message noting that the Case might not exist yet](/docs/assets/images/prometheus-case-not-ready-toast-92ac07b2b459d57c427746f3d15a6aae.png)](https://coralogix.com/docs/docs/assets/images/prometheus-case-not-ready-toast-92ac07b2b459d57c427746f3d15a6aae.png) Alert ingestion can lag slightly behind the notification, so retry after a moment if the Case is not found on the first attempt. To create the Cases in the first place, send your Prometheus alerts to Coralogix as described in [Prometheus Alert Manager data ingestion](https://coralogix.com/docs/docs/integrations/prometheus/prometheus-alertmanager-data-ingestion/.md). ### Build the link in your Alert Manager templates[​](#build-the-link-in-your-alert-manager-templates "Direct link to Build the link in your Alert Manager templates") Define a reusable template so every receiver builds the same link. Add a `templates/coralogix.tmpl` file and reference it from your Alert Manager configuration: templates/coralogix.tmpl ``` {{ define "coralogix.first_fingerprint" -}} {{- if gt (len .Alerts.Firing) 0 -}} {{- with index .Alerts.Firing 0 -}}{{ .Fingerprint }}{{- end -}} {{- else if gt (len .Alerts.Resolved) 0 -}} {{- with index .Alerts.Resolved 0 -}}{{ .Fingerprint }}{{- end -}} {{- end -}} {{- end }} {{ define "coralogix.first_start_time" -}} {{- if gt (len .Alerts.Firing) 0 -}} {{- with index .Alerts.Firing 0 -}}{{ date "2006-01-02T15:04:05.000Z" (tz "UTC" .StartsAt) }}{{- end -}} {{- else if gt (len .Alerts.Resolved) 0 -}} {{- with index .Alerts.Resolved 0 -}}{{ date "2006-01-02T15:04:05.000Z" (tz "UTC" .StartsAt) }}{{- end -}} {{- end -}} {{- end }} {{ define "coralogix.cases_url" -}} https:///#/cases?fingerprint={{ template "coralogix.first_fingerprint" . }}&start_time={{ template "coralogix.first_start_time" . }} {{- end }} ``` Load the template file and set your routing in `alertmanager.yml`. Replace `` with your own Coralogix team domain: alertmanager.yml ``` templates: - templates/*.tmpl route: receiver: slack-coralogix group_by: ['...'] group_wait: 10s group_interval: 5m repeat_interval: 4h ``` ### Reference the link from a receiver[​](#reference-the-link-from-a-receiver "Direct link to Reference the link from a receiver") Prometheus Alert Manager supports many integrations, each with its own configuration fields. The following examples wire the `coralogix.cases_url` template into common receivers. * Slack * Microsoft Teams v2 * PagerDuty ``` receivers: - name: slack-coralogix slack_configs: - api_url_file: /etc/alertmanager/secrets/slack-webhook-url channel: '#alerts' send_resolved: true title: '{{ .CommonLabels.alertname }}' title_link: '{{ template "coralogix.cases_url" . }}' text: '{{ .CommonAnnotations.summary }}' actions: - type: button text: Open Coralogix case url: '{{ template "coralogix.cases_url" . }}' ``` ``` receivers: - name: teams-coralogix msteamsv2_configs: - webhook_url_file: /etc/alertmanager/secrets/teams-webhook-url send_resolved: true title: '{{ .Status | toUpper }}: {{ .CommonLabels.alertname }}' text: | {{ .CommonAnnotations.summary }} [Open Coralogix case]({{ template "coralogix.cases_url" . }}) ``` ``` receivers: - name: pagerduty-coralogix pagerduty_configs: - routing_key_file: /etc/alertmanager/secrets/pagerduty-routing-key send_resolved: true description: '{{ .CommonLabels.alertname }}' client: Alertmanager client_url: '{{ template "coralogix.cases_url" . }}' details: coralogix_case_url: '{{ template "coralogix.cases_url" . }}' coralogix_fingerprint: '{{ template "coralogix.first_fingerprint" . }}' coralogix_start_time: '{{ template "coralogix.first_start_time" . }}' links: - href: '{{ template "coralogix.cases_url" . }}' text: Open Coralogix case ``` The `first_fingerprint` and `first_start_time` templates use the first alert in the notification group, so the link resolves to the Case for that alert. Adjust the templates if your grouping strategy needs a different alert. ## Related resources[​](#related-resources "Direct link to Related resources") * [Working with Cases](https://coralogix.com/docs/docs/user-guides/cases/working-with-cases/.md) * [Alert reasoning](https://coralogix.com/docs/docs/user-guides/cases/alert-reasoning/.md) * [Cases overview](https://coralogix.com/docs/docs/user-guides/cases/overview/.md)