Datto RMM Alerts · git:20260713.1fbd3f3 · 2026-07-13 · sha256 0249a699049550e5
Datto RMM Alerts git:20260713.1fbd3f3A
Immutable. This exact content never changes and is served at /api/v1/blob/0249a699049550e5.
---
name: "Datto RMM Alerts"
description: >
Use this skill when working with Datto RMM alerts - viewing, resolving,
and managing monitoring alerts. Covers all 25+ alert context types including
antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more.
Includes alert priorities, resolution workflows, and context-specific handling.
when_to_use: >-
When viewing, resolving, and managing monitoring alerts. Use when: datto alert, rmm alert,
device alert, alert resolution, monitoring alert, alert context, resolve alert, open alerts,
alert priority, antivirus alert, disk alert, or service alert.
---
# Datto RMM Alert Management
## Overview
Alerts are the primary notification mechanism in Datto RMM. They're generated by monitors when conditions are met - disk space low, service stopped, CPU high, etc. Each alert contains context-specific data based on the monitor type. This skill covers alert handling, the 25+ context types, and resolution workflows.
## Key Concepts
### Alert Structure
Every alert has:
- **alertUid** - Unique identifier for the alert
- **alertType** - Category of alert (Device Offline, Monitor, etc.)
- **priority** - Severity level (Critical, High, Moderate, Low, Information)
- **alertContext** - Type-specific data with `@class` discriminator
- **timestamp** - When the alert was raised (Unix milliseconds)
### Alert Priorities
| Priority | Value | Description | Typical Response |
|----------|-------|-------------|------------------|
| Critical | `Critical` | Severe impact, immediate action | 15 minutes |
| High | `High` | Significant issue | 1 hour |
| Moderate | `Moderate` | Notable but manageable | 4 hours |
| Low | `Low` | Minor issue | 8 hours |
| Information | `Information` | Informational only | Best effort |
### Alert States
| State | Description |
|-------|-------------|
| `open` | Active, requires attention |
| `resolved` | Closed, issue addressed |
## Field Reference
### Alert Object
```typescript
interface Alert {
// Identifiers
alertUid: string; // Unique alert ID
alertSourceInfo: AlertSource; // Source of the alert
// Device Info
deviceUid: string; // Device that generated alert
hostname: string; // Device hostname
// Classification
alertType: string; // "Monitor", "Device Offline", etc.
priority: AlertPriority; // Critical, High, Moderate, Low, Information
alertMessage: string; // Human-readable message
// Context (varies by @class)
alertContext: AlertContext; // Type-specific data
// Timestamps (Unix milliseconds)
timestamp: number; // When alert was raised
resolvedAt?: number; // When resolved (if resolved)
// Resolution
resolved: boolean;
resolvedBy?: string; // Who resolved it
resolution?: string; // Resolution notes
}
type AlertPriority = 'Critical' | 'High' | 'Moderate' | 'Low' | 'Information';
```
## Alert Context Types
Datto RMM has 25+ alert context types, identified by the `@class` field. Each type has specific fields relevant to that monitor.
### antivirus_ctx
Antivirus status and detection alerts.
```typescript
interface AntivirusContext {
"@class": "antivirus_ctx";
avProduct: string; // "Windows Defender", "Webroot", etc.
avStatus: string; // "Enabled", "Disabled", "Out of Date"
avDefinitionDate: number; // Last definition update (Unix ms)
threatName?: string; // Name of detected threat
threatPath?: string; // File path of threat
scanType?: string; // "Full", "Quick", "Real-time"
lastScan?: number; // Last scan timestamp
}
```
**Example Alert:**
```json
{
"alertMessage": "Antivirus definitions out of date",
"alertContext": {
"@class": "antivirus_ctx",
"avProduct": "Windows Defender",
"avStatus": "Out of Date",
"avDefinitionDate": 1707100000000
}
}
```
### comp_script_ctx
Component script execution results.
```typescript
interface ComponentScriptContext {
"@class": "comp_script_ctx";
componentName: string; // Script/component name
exitCode: number; // Process exit code
stdout: string; // Standard output
stderr: string; // Standard error
executionTime: number; // Duration in milliseconds
variables?: Record<string, string>; // Input variables
}
```
**Example Alert:**
```json
{
"alertMessage": "Component 'Backup Check' failed with exit code 1",
"alertContext": {
"@class": "comp_script_ctx",
"componentName": "Backup Check",
"exitCode": 1,
"stdout": "Checking backup status...",
"stderr": "ERROR: No backup found in last 24 hours"
}
}
```
### custom_snmp_ctx
SNMP monitoring alerts.
```typescript
interface CustomSNMPContext {
"@class": "custom_snmp_ctx";
oid: string; // SNMP OID
value: string | number; // Current value
threshold: number; // Configured threshold
comparison: string; // "gt", "lt", "eq", etc.
snmpVersion: string; // "v1", "v2c", "v3"
}
```
### disk_health_ctx
ESXi disk health monitoring.
```typescript
interface DiskHealthContext {
"@class": "disk_health_ctx";
diskName: string; // Disk identifier
status: string; // "Healthy", "Warning", "Critical"
capacity: number; // Total capacity (bytes)
smartStatus?: string; // S.M.A.R.T. status
temperature?: number; // Disk temperature (Celsius)
}
```
### eventlog_ctx
Windows Event Log monitoring.
```typescript
interface EventLogContext {
"@class": "eventlog_ctx";
logName: string; // "Application", "System", "Security"
source: string; // Event source
eventId: number; // Event ID
eventType: string; // "Error", "Warning", "Information"
message: string; // Event message
timestamp: number; // Event timestamp
user?: string; // Associated user
computer?: string; // Computer name
}
```
**Example Alert:**
```json
{
"alertMessage": "Event Log: BSOD detected",
"alertContext": {
"@class": "eventlog_ctx",
"logName": "System",
"source": "BugCheck",
"eventId": 1001,
"eventType": "Error",
"message": "The computer has rebooted from a bugcheck."
}
}
```
### fan_ctx
ESXi fan status monitoring.
```typescript
interface FanContext {
"@class": "fan_ctx";
fanName: string; // Fan identifier
status: string; // "OK", "Warning", "Critical"
rpm: number; // Current RPM
minRpm?: number; // Minimum threshold
}
```
### fs_object_ctx
File/folder size monitoring.
```typescript
interface FileSystemObjectContext {
"@class": "fs_object_ctx";
path: string; // File or folder path
size: number; // Current size (bytes)
threshold: number; // Size threshold (bytes)
comparison: string; // "gt", "lt"
isDirectory: boolean; // true for folders
fileCount?: number; // Number of files (for directories)
}
```
### online_offline_status_ctx
Device online/offline status changes.
```typescript
interface OnlineOfflineContext {
"@class": "online_offline_status_ctx";
status: string; // "offline", "online"
lastSeen: number; // Last check-in (Unix ms)
offlineDuration: number; // Minutes offline
previousStatus: string; // Status before change
}
```
**Example Alert:**
```json
{
"alertMessage": "Device went offline",
"alertContext": {
"@class": "online_offline_status_ctx",
"status": "offline",
"lastSeen": 1707991200000,
"offlineDuration": 45,
"previousStatus": "online"
}
}
```
### patch_ctx
Windows patch/update status.
```typescript
interface PatchContext {
"@class": "patch_ctx";
patchCount: number; // Total pending patches
criticalCount: number; // Critical patches pending
importantCount: number; // Important patches pending
optionalCount: number; // Optional patches pending
lastScan: number; // Last patch scan (Unix ms)
rebootRequired: boolean; // Needs restart
failedPatches?: string[]; // KB numbers that failed
}
```
### perf_disk_usage_ctx
Disk usage/space monitoring.
```typescript
interface DiskUsageContext {
"@class": "perf_disk_usage_ctx";
drive: string; // "C:", "D:", etc.
usagePercent: number; // Current usage percentage
threshold: number; // Alert threshold percentage
totalSpace: number; // Total space (bytes)
freeSpace: number; // Free space (bytes)
usedSpace: number; // Used space (bytes)
}
```
**Example Alert:**
```json
{
"alertMessage": "Disk C: is 95% full",
"alertContext": {
"@class": "perf_disk_usage_ctx",
"drive": "C:",
"usagePercent": 95,
"threshold": 90,
"totalSpace": 500000000000,
"freeSpace": 25000000000,
"usedSpace": 475000000000
}
}
```
### perf_mon_ctx
Windows Performance Counter monitoring.
```typescript
interface PerformanceMonitorContext {
"@class": "perf_mon_ctx";
counter: string; // Full counter path
instance: string; // Counter instance
value: number; // Current value
threshold: number; // Alert threshold
comparison: string; // "gt", "lt", "eq"
}
```
### perf_resource_usage_ctx
CPU/Memory usage monitoring.
```typescript
interface ResourceUsageContext {
"@class": "perf_resource_usage_ctx";
resource: string; // "CPU", "Memory"
usagePercent: number; // Current usage percentage
threshold: number; // Alert threshold
duration: number; // Duration over threshold (seconds)
processName?: string; // Top consuming process
processUsage?: number; // Process usage percentage
}
```
**Example Alert:**
```json
{
"alertMessage": "CPU usage above 90% for 15 minutes",
"alertContext": {
"@class": "perf_resource_usage_ctx",
"resource": "CPU",
"usagePercent": 94,
"threshold": 90,
"duration": 900,
"processName": "sqlservr.exe",
"processUsage": 78
}
}
```
### ping_ctx
Network ping monitoring.
```typescript
interface PingContext {
"@class": "ping_ctx";
host: string; // Target hostname/IP
latency: number; // Response time (ms)
packetLoss: number; // Packet loss percentage
threshold: number; // Latency threshold (ms)
status: string; // "reachable", "unreachable"
}
```
### process_resource_usage_ctx
Individual process resource monitoring.
```typescript
interface ProcessResourceContext {
"@class": "process_resource_usage_ctx";
processName: string; // Process name
pid: number; // Process ID
cpuUsage: number; // CPU percentage
memoryUsage: number; // Memory usage (bytes)
memoryPercent: number; // Memory percentage
threshold: number; // Alert threshold
}
```
### process_status_ctx
Process running/stopped monitoring.
```typescript
interface ProcessStatusContext {
"@class": "process_status_ctx";
processName: string; // Process name
status: string; // "running", "stopped"
expectedStatus: string; // "running", "stopped"
pid?: number; // Process ID (if running)
path?: string; // Executable path
}
```
### psu_ctx
ESXi power supply monitoring.
```typescript
interface PSUContext {
"@class": "psu_ctx";
psuName: string; // PSU identifier
status: string; // "OK", "Failed", "Degraded"
wattage?: number; // Current wattage
}
```
### ransomware_ctx
Ransomware detection alerts.
```typescript
interface RansomwareContext {
"@class": "ransomware_ctx";
detectionType: string; // "Behavioral", "Signature", "Honeypot"
path: string; // Affected path
action: string; // "Blocked", "Quarantined", "Detected"
processName?: string; // Suspicious process
fileCount?: number; // Number of affected files
extensions?: string[]; // Affected file extensions
}
```
**Example Alert:**
```json
{
"alertMessage": "Potential ransomware activity detected",
"alertContext": {
"@class": "ransomware_ctx",
"detectionType": "Behavioral",
"path": "C:\\Users\\John\\Documents",
"action": "Blocked",
"processName": "suspicious.exe",
"fileCount": 15,
"extensions": [".encrypted", ".locked"]
}
}
```
### sec_management_ctx
Webroot/security management status.
```typescript
interface SecurityManagementContext {
"@class": "sec_management_ctx";
product: string; // "Webroot", etc.
status: string; // "Active", "Inactive", "Expired"
threatCount: number; // Number of threats detected
lastScan: number; // Last scan timestamp
licenseExpiry?: number; // License expiration
}
```
### srvc_resource_usage_ctx
Windows Service resource monitoring.
```typescript
interface ServiceResourceContext {
"@class": "srvc_resource_usage_ctx";
serviceName: string; // Service name
displayName: string; // Service display name
cpuUsage: number; // CPU percentage
memoryUsage: number; // Memory (bytes)
threshold: number; // Alert threshold
}
```
### srvc_status_ctx
Windows Service status monitoring.
```typescript
interface ServiceStatusContext {
"@class": "srvc_status_ctx";
serviceName: string; // Service name
displayName: string; // Service display name
status: string; // "Running", "Stopped", "Paused"
expectedStatus: string; // Expected status
startType: string; // "Automatic", "Manual", "Disabled"
recoveryAction?: string; // Configured recovery action
}
```
**Example Alert:**
```json
{
"alertMessage": "Service 'SQL Server' is stopped",
"alertContext": {
"@class": "srvc_status_ctx",
"serviceName": "MSSQLSERVER",
"displayName": "SQL Server (MSSQLSERVER)",
"status": "Stopped",
"expectedStatus": "Running",
"startType": "Automatic"
}
}
```
### sw_action_ctx
Software installation/removal monitoring.
```typescript
interface SoftwareActionContext {
"@class": "sw_action_ctx";
action: string; // "Installed", "Uninstalled", "Updated"
softwareName: string; // Application name
version: string; // Software version
previousVersion?: string; // Previous version (for updates)
publisher?: string; // Software publisher
installDate: number; // Action timestamp
}
```
### temperature_ctx
ESXi temperature monitoring.
```typescript
interface TemperatureContext {
"@class": "temperature_ctx";
sensorName: string; // Sensor identifier
temperature: number; // Current temp (Celsius)
threshold: number; // Alert threshold
status: string; // "Normal", "Warning", "Critical"
}
```
### wmi_ctx
WMI query monitoring.
```typescript
interface WMIContext {
"@class": "wmi_ctx";
query: string; // WMI query executed
namespace: string; // WMI namespace
property: string; // Property monitored
value: string | number; // Current value
threshold?: string | number; // Threshold (if applicable)
}
```
## API Patterns
### Get All Open Alerts
```http
GET /api/v2/alerts/open
Authorization: Bearer {token}
```
### Get Open Alerts for Site
```http
GET /api/v2/site/{siteUid}/alerts/open
Authorization: Bearer {token}
```
### Get Open Alerts for Device
```http
GET /api/v2/device/{deviceUid}/alerts/open
Authorization: Bearer {token}
```
### Get Resolved Alerts
```http
GET /api/v2/alerts/resolved?max=250
Authorization: Bearer {token}
```
### Get Alerts Since Timestamp
```http
GET /api/v2/alerts/open?since=1707991200000
Authorization: Bearer {token}
```
### Resolve an Alert
```http
POST /api/v2/alert/{alertUid}/resolve
Authorization: Bearer {token}
Content-Type: application/json
{
"resolution": "Cleared disk space by removing temp files"
}
```
**Note:** Muting alerts (PUT to /alert/{alertUid}/mute) is deprecated. Use resolve instead.
## Workflows
### Alert Triage by Priority
```javascript
async function triageAlerts(client) {
const alerts = await client.request('/api/v2/alerts/open');
const triaged = {
critical: [],
high: [],
moderate: [],
low: [],
information: []
};
alerts.alerts.forEach(alert => {
const bucket = alert.priority.toLowerCase();
if (triaged[bucket]) {
triaged[bucket].push(alert);
}
});
return triaged;
}
```
### Context-Aware Alert Handling
```javascript
function getAlertRecommendation(alert) {
const ctx = alert.alertContext;
switch (ctx['@class']) {
case 'perf_disk_usage_ctx':
return {
severity: ctx.usagePercent >= 95 ? 'critical' : 'warning',
action: 'Clear disk space or expand volume',
steps: [
'Run Disk Cleanup utility',
'Clear temp files',
'Check for large log files',
'Consider expanding disk'
]
};
case 'srvc_status_ctx':
return {
severity: 'high',
action: `Start the ${ctx.displayName} service`,
steps: [
`Run: net start "${ctx.serviceName}"`,
'Check Event Log for failure reason',
'Verify service account credentials',
'Check dependencies'
]
};
case 'ransomware_ctx':
return {
severity: 'critical',
action: 'IMMEDIATE: Isolate device and investigate',
steps: [
'Disconnect from network immediately',
'Do NOT restart the device',
'Contact security team',
'Preserve evidence',
'Check for lateral movement'
]
};
case 'online_offline_status_ctx':
return {
severity: ctx.offlineDuration > 60 ? 'high' : 'moderate',
action: 'Verify device connectivity',
steps: [
'Ping device from network',
'Check physical connectivity',
'Verify no scheduled maintenance',
'Contact on-site user if available'
]
};
default:
return {
severity: 'moderate',
action: 'Review alert details',
steps: ['Investigate alert context', 'Check device status']
};
}
}
```
### Batch Alert Resolution
```javascript
async function resolveAlertsBatch(client, alertUids, resolution) {
const results = [];
for (const alertUid of alertUids) {
try {
await client.request(`/api/v2/alert/${alertUid}/resolve`, {
method: 'POST',
body: JSON.stringify({ resolution })
});
results.push({ alertUid, success: true });
} catch (error) {
results.push({ alertUid, success: false, error: error.message });
}
// Respect rate limits
await sleep(100);
}
return results;
}
```
### Alert Summary Report
```javascript
async function generateAlertSummary(client, options = {}) {
const { siteUid, deviceUid } = options;
let url = '/api/v2/alerts/open';
if (siteUid) url = `/api/v2/site/${siteUid}/alerts/open`;
if (deviceUid) url = `/api/v2/device/${deviceUid}/alerts/open`;
const response = await client.request(url);
const alerts = response.alerts || [];
// Group by type
const byType = {};
alerts.forEach(alert => {
const type = alert.alertContext?.['@class'] || 'unknown';
if (!byType[type]) byType[type] = [];
byType[type].push(alert);
});
// Group by priority
const byPriority = {
Critical: 0,
High: 0,
Moderate: 0,
Low: 0,
Information: 0
};
alerts.forEach(alert => {
if (byPriority[alert.priority] !== undefined) {
byPriority[alert.priority]++;
}
});
return {
totalOpen: alerts.length,
byPriority,
byType: Object.entries(byType).map(([type, items]) => ({
type,
count: items.length
})),
oldestAlert: alerts.length > 0
? Math.min(...alerts.map(a => a.timestamp))
: null
};
}
```
## Error Handling
### Common Alert API Errors
| Error | Status | Cause | Resolution |
|-------|--------|-------|------------|
| Alert not found | 404 | Invalid alertUid | Verify alert exists |
| Already resolved | 400 | Alert already closed | Check alert state first |
| Permission denied | 403 | API restrictions | Check API permissions |
### Error Handling Pattern
```javascript
async function safeResolveAlert(client, alertUid, resolution) {
try {
await client.request(`/api/v2/alert/${alertUid}/resolve`, {
method: 'POST',
body: JSON.stringify({ resolution })
});
return { success: true };
} catch (error) {
if (error.status === 404) {
return { success: false, reason: 'Alert not found - may already be resolved' };
}
if (error.status === 400) {
return { success: false, reason: 'Alert already resolved' };
}
throw error;
}
}
```
## Best Practices
1. **Prioritize by severity** - Handle Critical and High alerts first
2. **Use context data** - Each @class has specific actionable fields
3. **Document resolutions** - Include what was done and outcome
4. **Set up escalation** - Auto-escalate stale high-priority alerts
5. **Monitor patterns** - Repeated alerts may indicate larger issues
6. **Use site filtering** - Scope alerts to relevant sites when possible
7. **Handle ransomware specially** - Immediate isolation protocol
8. **Track resolution time** - Measure alert-to-resolution duration
9. **Correlate alerts** - Multiple alerts may share root cause
10. **Review resolved alerts** - Learn from past incidents
## Alert Priority Matrix
| Context Type | Typical Priority | Notes |
|--------------|-----------------|-------|
| `ransomware_ctx` | Critical | Always immediate action |
| `online_offline_status_ctx` (server) | High | Business impact |
| `perf_disk_usage_ctx` (>95%) | High | Data loss risk |
| `srvc_status_ctx` (critical service) | High | Service impact |
| `antivirus_ctx` (threat detected) | High | Security risk |
| `perf_resource_usage_ctx` | Moderate | Performance impact |
| `patch_ctx` (critical patches) | Moderate | Security debt |
| `eventlog_ctx` | Varies | Based on event severity |
| `sw_action_ctx` | Low | Informational |
## Related Skills
- [Datto RMM Devices](../devices/SKILL.md) - Device management
- [Datto RMM Sites](../sites/SKILL.md) - Site-level alert views
- [Datto RMM Jobs](../jobs/SKILL.md) - Remediation jobs
- [Datto RMM API Patterns](../api-patterns/SKILL.md) - Authentication and pagination