Datto RMM Alerts ยท diff
git:20260713.1fbd3f3 to git:20260728.b7e78fc
32 added, 550 removed. Audit A to A.
---
name: "Datto RMM Alerts"
description: >
- Use this skill when working with Datto RMM alerts - viewing, resolving,
- and managing monitoring alerts. Covers all 25+ alert context types including
- antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more.
- Includes alert priorities, resolution workflows, and context-specific handling.
+ Datto RMM alert structure, priorities, and the 25+ alert context types
+ (antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and
+ more), each with its own type-specific fields. Covers alert resolution
+ workflows and context-specific triage guidance.
when_to_use: >-
When viewing, resolving, and managing monitoring alerts. Use when: datto alert, rmm alert,
device alert, alert resolution, monitoring alert, alert context, resolve alert, open alerts,
alert priority, antivirus alert, disk alert, or service alert.
---
# Datto RMM Alert Management
## Overview
Alerts are the primary notification mechanism in Datto RMM. They're generated by monitors when conditions are met - disk space low, service stopped, CPU high, etc. Each alert contains context-specific data based on the monitor type. This skill covers alert handling, the 25+ context types, and resolution workflows.
## Key Concepts
### Alert Structure
Every alert has:
- **alertUid** - Unique identifier for the alert
- **alertType** - Category of alert (Device Offline, Monitor, etc.)
- **priority** - Severity level (Critical, High, Moderate, Low, Information)
- **alertContext** - Type-specific data with `@class` discriminator
- **timestamp** - When the alert was raised (Unix milliseconds)
### Alert Priorities
| Priority | Value | Description | Typical Response |
|----------|-------|-------------|------------------|
| Critical | `Critical` | Severe impact, immediate action | 15 minutes |
| High | `High` | Significant issue | 1 hour |
| Moderate | `Moderate` | Notable but manageable | 4 hours |
| Low | `Low` | Minor issue | 8 hours |
| Information | `Information` | Informational only | Best effort |
### Alert States
| State | Description |
|-------|-------------|
| `open` | Active, requires attention |
| `resolved` | Closed, issue addressed |
## Field Reference
### Alert Object
```typescript
interface Alert {
// Identifiers
alertUid: string; // Unique alert ID
alertSourceInfo: AlertSource; // Source of the alert
// Device Info
deviceUid: string; // Device that generated alert
hostname: string; // Device hostname
// Classification
alertType: string; // "Monitor", "Device Offline", etc.
priority: AlertPriority; // Critical, High, Moderate, Low, Information
alertMessage: string; // Human-readable message
// Context (varies by @class)
alertContext: AlertContext; // Type-specific data
// Timestamps (Unix milliseconds)
timestamp: number; // When alert was raised
resolvedAt?: number; // When resolved (if resolved)
// Resolution
resolved: boolean;
resolvedBy?: string; // Who resolved it
resolution?: string; // Resolution notes
}
type AlertPriority = 'Critical' | 'High' | 'Moderate' | 'Low' | 'Information';
```
## Alert Context Types
- Datto RMM has 25+ alert context types, identified by the `@class` field. Each type has specific fields relevant to that monitor.
-
- ### antivirus_ctx
-
- Antivirus status and detection alerts.
-
- ```typescript
- interface AntivirusContext {
- "@class": "antivirus_ctx";
- avProduct: string; // "Windows Defender", "Webroot", etc.
- avStatus: string; // "Enabled", "Disabled", "Out of Date"
- avDefinitionDate: number; // Last definition update (Unix ms)
- threatName?: string; // Name of detected threat
- threatPath?: string; // File path of threat
- scanType?: string; // "Full", "Quick", "Real-time"
- lastScan?: number; // Last scan timestamp
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Antivirus definitions out of date",
- "alertContext": {
- "@class": "antivirus_ctx",
- "avProduct": "Windows Defender",
- "avStatus": "Out of Date",
- "avDefinitionDate": 1707100000000
- }
- }
- ```
-
- ### comp_script_ctx
-
- Component script execution results.
-
- ```typescript
- interface ComponentScriptContext {
- "@class": "comp_script_ctx";
- componentName: string; // Script/component name
- exitCode: number; // Process exit code
- stdout: string; // Standard output
- stderr: string; // Standard error
- executionTime: number; // Duration in milliseconds
- variables?: Record<string, string>; // Input variables
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Component 'Backup Check' failed with exit code 1",
- "alertContext": {
- "@class": "comp_script_ctx",
- "componentName": "Backup Check",
- "exitCode": 1,
- "stdout": "Checking backup status...",
- "stderr": "ERROR: No backup found in last 24 hours"
- }
- }
- ```
-
- ### custom_snmp_ctx
-
- SNMP monitoring alerts.
-
- ```typescript
- interface CustomSNMPContext {
- "@class": "custom_snmp_ctx";
- oid: string; // SNMP OID
- value: string | number; // Current value
- threshold: number; // Configured threshold
- comparison: string; // "gt", "lt", "eq", etc.
- snmpVersion: string; // "v1", "v2c", "v3"
- }
- ```
-
- ### disk_health_ctx
-
- ESXi disk health monitoring.
-
- ```typescript
- interface DiskHealthContext {
- "@class": "disk_health_ctx";
- diskName: string; // Disk identifier
- status: string; // "Healthy", "Warning", "Critical"
- capacity: number; // Total capacity (bytes)
- smartStatus?: string; // S.M.A.R.T. status
- temperature?: number; // Disk temperature (Celsius)
- }
- ```
-
- ### eventlog_ctx
-
- Windows Event Log monitoring.
-
- ```typescript
- interface EventLogContext {
- "@class": "eventlog_ctx";
- logName: string; // "Application", "System", "Security"
- source: string; // Event source
- eventId: number; // Event ID
- eventType: string; // "Error", "Warning", "Information"
- message: string; // Event message
- timestamp: number; // Event timestamp
- user?: string; // Associated user
- computer?: string; // Computer name
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Event Log: BSOD detected",
- "alertContext": {
- "@class": "eventlog_ctx",
- "logName": "System",
- "source": "BugCheck",
- "eventId": 1001,
- "eventType": "Error",
- "message": "The computer has rebooted from a bugcheck."
- }
- }
- ```
-
- ### fan_ctx
-
- ESXi fan status monitoring.
-
- ```typescript
- interface FanContext {
- "@class": "fan_ctx";
- fanName: string; // Fan identifier
- status: string; // "OK", "Warning", "Critical"
- rpm: number; // Current RPM
- minRpm?: number; // Minimum threshold
- }
- ```
-
- ### fs_object_ctx
-
- File/folder size monitoring.
-
- ```typescript
- interface FileSystemObjectContext {
- "@class": "fs_object_ctx";
- path: string; // File or folder path
- size: number; // Current size (bytes)
- threshold: number; // Size threshold (bytes)
- comparison: string; // "gt", "lt"
- isDirectory: boolean; // true for folders
- fileCount?: number; // Number of files (for directories)
- }
- ```
-
- ### online_offline_status_ctx
-
- Device online/offline status changes.
-
- ```typescript
- interface OnlineOfflineContext {
- "@class": "online_offline_status_ctx";
- status: string; // "offline", "online"
- lastSeen: number; // Last check-in (Unix ms)
- offlineDuration: number; // Minutes offline
- previousStatus: string; // Status before change
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Device went offline",
- "alertContext": {
- "@class": "online_offline_status_ctx",
- "status": "offline",
- "lastSeen": 1707991200000,
- "offlineDuration": 45,
- "previousStatus": "online"
- }
- }
- ```
-
- ### patch_ctx
-
- Windows patch/update status.
-
- ```typescript
- interface PatchContext {
- "@class": "patch_ctx";
- patchCount: number; // Total pending patches
- criticalCount: number; // Critical patches pending
- importantCount: number; // Important patches pending
- optionalCount: number; // Optional patches pending
- lastScan: number; // Last patch scan (Unix ms)
- rebootRequired: boolean; // Needs restart
- failedPatches?: string[]; // KB numbers that failed
- }
- ```
-
- ### perf_disk_usage_ctx
-
- Disk usage/space monitoring.
-
- ```typescript
- interface DiskUsageContext {
- "@class": "perf_disk_usage_ctx";
- drive: string; // "C:", "D:", etc.
- usagePercent: number; // Current usage percentage
- threshold: number; // Alert threshold percentage
- totalSpace: number; // Total space (bytes)
- freeSpace: number; // Free space (bytes)
- usedSpace: number; // Used space (bytes)
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Disk C: is 95% full",
- "alertContext": {
- "@class": "perf_disk_usage_ctx",
- "drive": "C:",
- "usagePercent": 95,
- "threshold": 90,
- "totalSpace": 500000000000,
- "freeSpace": 25000000000,
- "usedSpace": 475000000000
- }
- }
- ```
-
- ### perf_mon_ctx
-
- Windows Performance Counter monitoring.
-
- ```typescript
- interface PerformanceMonitorContext {
- "@class": "perf_mon_ctx";
- counter: string; // Full counter path
- instance: string; // Counter instance
- value: number; // Current value
- threshold: number; // Alert threshold
- comparison: string; // "gt", "lt", "eq"
- }
- ```
-
- ### perf_resource_usage_ctx
-
- CPU/Memory usage monitoring.
-
- ```typescript
- interface ResourceUsageContext {
- "@class": "perf_resource_usage_ctx";
- resource: string; // "CPU", "Memory"
- usagePercent: number; // Current usage percentage
- threshold: number; // Alert threshold
- duration: number; // Duration over threshold (seconds)
- processName?: string; // Top consuming process
- processUsage?: number; // Process usage percentage
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "CPU usage above 90% for 15 minutes",
- "alertContext": {
- "@class": "perf_resource_usage_ctx",
- "resource": "CPU",
- "usagePercent": 94,
- "threshold": 90,
- "duration": 900,
- "processName": "sqlservr.exe",
- "processUsage": 78
- }
- }
- ```
-
- ### ping_ctx
-
- Network ping monitoring.
-
- ```typescript
- interface PingContext {
- "@class": "ping_ctx";
- host: string; // Target hostname/IP
- latency: number; // Response time (ms)
- packetLoss: number; // Packet loss percentage
- threshold: number; // Latency threshold (ms)
- status: string; // "reachable", "unreachable"
- }
- ```
-
- ### process_resource_usage_ctx
-
- Individual process resource monitoring.
-
- ```typescript
- interface ProcessResourceContext {
- "@class": "process_resource_usage_ctx";
- processName: string; // Process name
- pid: number; // Process ID
- cpuUsage: number; // CPU percentage
- memoryUsage: number; // Memory usage (bytes)
- memoryPercent: number; // Memory percentage
- threshold: number; // Alert threshold
- }
- ```
-
- ### process_status_ctx
-
- Process running/stopped monitoring.
-
- ```typescript
- interface ProcessStatusContext {
- "@class": "process_status_ctx";
- processName: string; // Process name
- status: string; // "running", "stopped"
- expectedStatus: string; // "running", "stopped"
- pid?: number; // Process ID (if running)
- path?: string; // Executable path
- }
- ```
-
- ### psu_ctx
-
- ESXi power supply monitoring.
-
- ```typescript
- interface PSUContext {
- "@class": "psu_ctx";
- psuName: string; // PSU identifier
- status: string; // "OK", "Failed", "Degraded"
- wattage?: number; // Current wattage
- }
- ```
-
- ### ransomware_ctx
-
- Ransomware detection alerts.
-
- ```typescript
- interface RansomwareContext {
- "@class": "ransomware_ctx";
- detectionType: string; // "Behavioral", "Signature", "Honeypot"
- path: string; // Affected path
- action: string; // "Blocked", "Quarantined", "Detected"
- processName?: string; // Suspicious process
- fileCount?: number; // Number of affected files
- extensions?: string[]; // Affected file extensions
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Potential ransomware activity detected",
- "alertContext": {
- "@class": "ransomware_ctx",
- "detectionType": "Behavioral",
- "path": "C:\\Users\\John\\Documents",
- "action": "Blocked",
- "processName": "suspicious.exe",
- "fileCount": 15,
- "extensions": [".encrypted", ".locked"]
- }
- }
- ```
-
- ### sec_management_ctx
-
- Webroot/security management status.
-
- ```typescript
- interface SecurityManagementContext {
- "@class": "sec_management_ctx";
- product: string; // "Webroot", etc.
- status: string; // "Active", "Inactive", "Expired"
- threatCount: number; // Number of threats detected
- lastScan: number; // Last scan timestamp
- licenseExpiry?: number; // License expiration
- }
- ```
-
- ### srvc_resource_usage_ctx
-
- Windows Service resource monitoring.
-
- ```typescript
- interface ServiceResourceContext {
- "@class": "srvc_resource_usage_ctx";
- serviceName: string; // Service name
- displayName: string; // Service display name
- cpuUsage: number; // CPU percentage
- memoryUsage: number; // Memory (bytes)
- threshold: number; // Alert threshold
- }
- ```
-
- ### srvc_status_ctx
-
- Windows Service status monitoring.
-
- ```typescript
- interface ServiceStatusContext {
- "@class": "srvc_status_ctx";
- serviceName: string; // Service name
- displayName: string; // Service display name
- status: string; // "Running", "Stopped", "Paused"
- expectedStatus: string; // Expected status
- startType: string; // "Automatic", "Manual", "Disabled"
- recoveryAction?: string; // Configured recovery action
- }
- ```
-
- **Example Alert:**
- ```json
- {
- "alertMessage": "Service 'SQL Server' is stopped",
- "alertContext": {
- "@class": "srvc_status_ctx",
- "serviceName": "MSSQLSERVER",
- "displayName": "SQL Server (MSSQLSERVER)",
- "status": "Stopped",
- "expectedStatus": "Running",
- "startType": "Automatic"
- }
- }
- ```
-
- ### sw_action_ctx
-
- Software installation/removal monitoring.
-
- ```typescript
- interface SoftwareActionContext {
- "@class": "sw_action_ctx";
- action: string; // "Installed", "Uninstalled", "Updated"
- softwareName: string; // Application name
- version: string; // Software version
- previousVersion?: string; // Previous version (for updates)
- publisher?: string; // Software publisher
- installDate: number; // Action timestamp
- }
- ```
-
- ### temperature_ctx
-
- ESXi temperature monitoring.
-
- ```typescript
- interface TemperatureContext {
- "@class": "temperature_ctx";
- sensorName: string; // Sensor identifier
- temperature: number; // Current temp (Celsius)
- threshold: number; // Alert threshold
- status: string; // "Normal", "Warning", "Critical"
- }
- ```
-
- ### wmi_ctx
+ Datto RMM has 25+ alert context types, identified by the `@class` field in `alertContext`. Each type carries fields specific to that monitor.
- WMI query monitoring.
+ | `@class` | Monitor | Key Fields |
+ |----------|---------|------------|
+ | `antivirus_ctx` | Antivirus status/detection | avProduct, avStatus, threatName, threatPath |
+ | `comp_script_ctx` | Component script execution | componentName, exitCode, stdout, stderr |
+ | `custom_snmp_ctx` | SNMP monitoring | oid, value, threshold, comparison |
+ | `disk_health_ctx` | ESXi disk health | diskName, status, smartStatus, temperature |
+ | `eventlog_ctx` | Windows Event Log | logName, source, eventId, eventType, message |
+ | `fan_ctx` | ESXi fan status | fanName, status, rpm |
+ | `fs_object_ctx` | File/folder size | path, size, threshold, isDirectory |
+ | `online_offline_status_ctx` | Device online/offline | status, lastSeen, offlineDuration |
+ | `patch_ctx` | Windows patch status | patchCount, criticalCount, rebootRequired |
+ | `perf_disk_usage_ctx` | Disk usage/space | drive, usagePercent, freeSpace, usedSpace |
+ | `perf_mon_ctx` | Windows Performance Counter | counter, instance, value, threshold |
+ | `perf_resource_usage_ctx` | CPU/Memory usage | resource, usagePercent, duration, processName |
+ | `ping_ctx` | Network ping | host, latency, packetLoss, status |
+ | `process_resource_usage_ctx` | Process resource usage | processName, pid, cpuUsage, memoryUsage |
+ | `process_status_ctx` | Process running/stopped | processName, status, expectedStatus |
+ | `psu_ctx` | ESXi power supply | psuName, status, wattage |
+ | `ransomware_ctx` | Ransomware detection | detectionType, path, action, fileCount |
+ | `sec_management_ctx` | Webroot/security management | product, status, threatCount, licenseExpiry |
+ | `srvc_resource_usage_ctx` | Windows Service resource usage | serviceName, cpuUsage, memoryUsage |
+ | `srvc_status_ctx` | Windows Service status | serviceName, status, expectedStatus, startType |
+ | `sw_action_ctx` | Software install/remove | action, softwareName, version, publisher |
+ | `temperature_ctx` | ESXi temperature | sensorName, temperature, threshold, status |
+ | `wmi_ctx` | WMI query monitoring | query, namespace, property, value |
- ```typescript
- interface WMIContext {
- "@class": "wmi_ctx";
- query: string; // WMI query executed
- namespace: string; // WMI namespace
- property: string; // Property monitored
- value: string | number; // Current value
- threshold?: string | number; // Threshold (if applicable)
- }
- ```
+ See [references/alert-contexts.md](references/alert-contexts.md) for the complete field definitions and example alerts for each context type.
## API Patterns
### Get All Open Alerts
```http
GET /api/v2/alerts/open
Authorization: Bearer {token}
```
### Get Open Alerts for Site
```http
GET /api/v2/site/{siteUid}/alerts/open
Authorization: Bearer {token}
```
### Get Open Alerts for Device
```http
GET /api/v2/device/{deviceUid}/alerts/open
Authorization: Bearer {token}
```
### Get Resolved Alerts
```http
GET /api/v2/alerts/resolved?max=250
Authorization: Bearer {token}
```
### Get Alerts Since Timestamp
```http
GET /api/v2/alerts/open?since=1707991200000
Authorization: Bearer {token}
```
### Resolve an Alert
```http
POST /api/v2/alert/{alertUid}/resolve
Authorization: Bearer {token}
Content-Type: application/json
{
"resolution": "Cleared disk space by removing temp files"
}
```
**Note:** Muting alerts (PUT to /alert/{alertUid}/mute) is deprecated. Use resolve instead.
## Workflows
### Alert Triage by Priority
```javascript
async function triageAlerts(client) {
const alerts = await client.request('/api/v2/alerts/open');
const triaged = {
critical: [],
high: [],
moderate: [],
low: [],
information: []
};
alerts.alerts.forEach(alert => {
const bucket = alert.priority.toLowerCase();
if (triaged[bucket]) {
triaged[bucket].push(alert);
}
});
return triaged;
}
```
### Context-Aware Alert Handling
```javascript
function getAlertRecommendation(alert) {
const ctx = alert.alertContext;
switch (ctx['@class']) {
case 'perf_disk_usage_ctx':
return {
severity: ctx.usagePercent >= 95 ? 'critical' : 'warning',
action: 'Clear disk space or expand volume',
steps: [
'Run Disk Cleanup utility',
'Clear temp files',
'Check for large log files',
'Consider expanding disk'
]
};
case 'srvc_status_ctx':
return {
severity: 'high',
action: `Start the ${ctx.displayName} service`,
steps: [
`Run: net start "${ctx.serviceName}"`,
'Check Event Log for failure reason',
'Verify service account credentials',
'Check dependencies'
]
};
case 'ransomware_ctx':
return {
severity: 'critical',
action: 'IMMEDIATE: Isolate device and investigate',
steps: [
'Disconnect from network immediately',
'Do NOT restart the device',
'Contact security team',
'Preserve evidence',
'Check for lateral movement'
]
};
case 'online_offline_status_ctx':
return {
severity: ctx.offlineDuration > 60 ? 'high' : 'moderate',
action: 'Verify device connectivity',
steps: [
'Ping device from network',
'Check physical connectivity',
'Verify no scheduled maintenance',
'Contact on-site user if available'
]
};
default:
return {
severity: 'moderate',
action: 'Review alert details',
steps: ['Investigate alert context', 'Check device status']
};
}
}
```
- ### Batch Alert Resolution
-
- ```javascript
- async function resolveAlertsBatch(client, alertUids, resolution) {
- const results = [];
-
- for (const alertUid of alertUids) {
- try {
- await client.request(`/api/v2/alert/${alertUid}/resolve`, {
- method: 'POST',
- body: JSON.stringify({ resolution })
- });
- results.push({ alertUid, success: true });
- } catch (error) {
- results.push({ alertUid, success: false, error: error.message });
- }
-
- // Respect rate limits
- await sleep(100);
- }
-
- return results;
- }
- ```
-
- ### Alert Summary Report
-
- ```javascript
- async function generateAlertSummary(client, options = {}) {
- const { siteUid, deviceUid } = options;
-
- let url = '/api/v2/alerts/open';
- if (siteUid) url = `/api/v2/site/${siteUid}/alerts/open`;
- if (deviceUid) url = `/api/v2/device/${deviceUid}/alerts/open`;
-
- const response = await client.request(url);
- const alerts = response.alerts || [];
-
- // Group by type
- const byType = {};
- alerts.forEach(alert => {
- const type = alert.alertContext?.['@class'] || 'unknown';
- if (!byType[type]) byType[type] = [];
- byType[type].push(alert);
- });
-
- // Group by priority
- const byPriority = {
- Critical: 0,
- High: 0,
- Moderate: 0,
- Low: 0,
- Information: 0
- };
- alerts.forEach(alert => {
- if (byPriority[alert.priority] !== undefined) {
- byPriority[alert.priority]++;
- }
- });
-
- return {
- totalOpen: alerts.length,
- byPriority,
- byType: Object.entries(byType).map(([type, items]) => ({
- type,
- count: items.length
- })),
- oldestAlert: alerts.length > 0
- ? Math.min(...alerts.map(a => a.timestamp))
- : null
- };
- }
- ```
+ See [references/examples.md](references/examples.md) for batch alert resolution and alert summary report examples.
## Error Handling
### Common Alert API Errors
| Error | Status | Cause | Resolution |
|-------|--------|-------|------------|
| Alert not found | 404 | Invalid alertUid | Verify alert exists |
| Already resolved | 400 | Alert already closed | Check alert state first |
| Permission denied | 403 | API restrictions | Check API permissions |
### Error Handling Pattern
```javascript
async function safeResolveAlert(client, alertUid, resolution) {
try {
await client.request(`/api/v2/alert/${alertUid}/resolve`, {
method: 'POST',
body: JSON.stringify({ resolution })
});
return { success: true };
} catch (error) {
if (error.status === 404) {
return { success: false, reason: 'Alert not found - may already be resolved' };
}
if (error.status === 400) {
return { success: false, reason: 'Alert already resolved' };
}
throw error;
}
}
```
## Best Practices
1. **Prioritize by severity** - Handle Critical and High alerts first
2. **Use context data** - Each @class has specific actionable fields
3. **Document resolutions** - Include what was done and outcome
4. **Set up escalation** - Auto-escalate stale high-priority alerts
5. **Monitor patterns** - Repeated alerts may indicate larger issues
6. **Use site filtering** - Scope alerts to relevant sites when possible
7. **Handle ransomware specially** - Immediate isolation protocol
8. **Track resolution time** - Measure alert-to-resolution duration
9. **Correlate alerts** - Multiple alerts may share root cause
10. **Review resolved alerts** - Learn from past incidents
## Alert Priority Matrix
| Context Type | Typical Priority | Notes |
|--------------|-----------------|-------|
| `ransomware_ctx` | Critical | Always immediate action |
| `online_offline_status_ctx` (server) | High | Business impact |
| `perf_disk_usage_ctx` (>95%) | High | Data loss risk |
| `srvc_status_ctx` (critical service) | High | Service impact |
| `antivirus_ctx` (threat detected) | High | Security risk |
| `perf_resource_usage_ctx` | Moderate | Performance impact |
| `patch_ctx` (critical patches) | Moderate | Security debt |
| `eventlog_ctx` | Varies | Based on event severity |
| `sw_action_ctx` | Low | Informational |
## Related Skills
- [Datto RMM Devices](../devices/SKILL.md) - Device management
- [Datto RMM Sites](../sites/SKILL.md) - Site-level alert views
- [Datto RMM Jobs](../jobs/SKILL.md) - Remediation jobs
- [Datto RMM API Patterns](../api-patterns/SKILL.md) - Authentication and pagination