kf alert
Define alert rules, acknowledge triggers, and manage analytics alerts.
kf alert acknowledge-trigger
Mark an OPEN/ESCALATED trigger as ACKNOWLEDGED.
Mark an OPEN/ESCALATED trigger as ACKNOWLEDGED. Signals that someone is working it; does not resolve. Use ResolveAlertTrigger to close.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--trigger-id <value> | yes | Trigger id. |
--note <value> | no | Note. |
Example
kf alert acknowledge-trigger --tenant tnt_demo --actor-type USER --actor-id usr_sam --trigger-id <value>kf alert create-analytics
Create an analytics alert rule.
Create an analytics alert rule. Thin wrapper around UpsertAlertRule that validates scope vs metricSource agreement and enforces staff authority for scope=PLATFORM. TENANT rules run at R2 with analytics.alert:write; PLATFORM rules run at R3 with analytics.alert.platform:write.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--rule-key <value> | yes | Rule key. |
--display-name <value> | yes | Display name. |
--description <value> | no | Description. |
--severity <value> | yes | Severity. |
--spec <value> | yes | Spec. |
--channels <value> | no | Channels. |
--escalation-after-hours <value> | no | Escalation after hours. |
--mute-until <value> | no | Mute until. |
--scope <value> | no | Scope. |
Example
kf alert create-analytics --tenant tnt_demo --actor-type USER --actor-id usr_sam --rule-key <value> --display-name <value> --severity <value> --spec <value>kf alert delete-analytics
Soft-delete an analytics alert rule by flipping status to DELETED.
Soft-delete an analytics alert rule by flipping status to DELETED. The row stays on alert_rules so triggers keep their FK target; the evaluator skip-filters DELETED rows.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--rule-key <value> | yes | Rule key. |
--scope <value> | yes | Scope. |
--expected-version <value> | yes | Expected version. |
Example
kf alert delete-analytics --tenant tnt_demo --actor-type USER --actor-id usr_sam --rule-key <value> --scope <value> --expected-version <value>kf alert mute-analytics
Set or clear mute_until on an analytics alert rule.
Set or clear mute_until on an analytics alert rule. Muting holds the evaluator back from firing while leaving any open triggers in place; pass muteUntil=null to resume evaluation.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--rule-key <value> | yes | Rule key. |
--scope <value> | yes | Scope. |
--mute-until <value> | yes | Mute until. |
--expected-version <value> | yes | Expected version. |
Example
kf alert mute-analytics --tenant tnt_demo --actor-type USER --actor-id usr_sam --rule-key <value> --scope <value> --mute-until <value> --expected-version <value>kf alert resolve-trigger
Manually resolve a trigger with a resolution reason.
Manually resolve a trigger with a resolution reason. Emits alerts.trigger.resolved with cause=manual to distinguish from auto-resolve by EvaluateAlertRule when the metric returns to band.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--trigger-id <value> | yes | Trigger id. |
--resolution-reason <value> | yes | Resolution reason. |
Example
kf alert resolve-trigger --tenant tnt_demo --actor-type USER --actor-id usr_sam --trigger-id <value> --resolution-reason <value>kf alert update-analytics
CAS update of an existing analytics alert rule.
CAS update of an existing analytics alert rule. Re-validates scope vs metricSource agreement; refuses scope flips (delete then create instead). Underlying write goes through UpsertAlertRule so the outbox transaction is unchanged.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--rule-key <value> | yes | Rule key. |
--display-name <value> | yes | Display name. |
--description <value> | no | Description. |
--severity <value> | yes | Severity. |
--spec <value> | yes | Spec. |
--channels <value> | no | Channels. |
--escalation-after-hours <value> | no | Escalation after hours. |
--mute-until <value> | no | Mute until. |
--scope <value> | yes | Scope. |
--status <value> | no | Status. |
--expected-version <value> | yes | Expected version. |
Example
kf alert update-analytics --tenant tnt_demo --actor-type USER --actor-id usr_sam --rule-key <value> --display-name <value> --severity <value> --spec <value> --scope <value> --expected-version <value>kf alert upsert-rule
Create or update a declarative alert rule (THRESHOLD, EVENT_PATTERN, or COUNT_WINDOW).
Create or update a declarative alert rule (THRESHOLD, EVENT_PATTERN, or COUNT_WINDOW). Rules drive pull-mode evaluations via EvaluateAlertRule and push-mode firing via MatchEventToAlertRules. Channels are logical names routed by downstream workers; no vendor is hardcoded.
| Flag | Required | Description |
|---|---|---|
--tenant <id> | yes | Target tenant id. |
--environment <id> | no | Target environment id; defaults to the active profile environment. |
--actor-type <type> | yes | Actor type (USER, SYSTEM, CONNECTOR, AGENT, SERVICE). |
--actor-id <id> | yes | Actor id. |
--idempotency-key <key> | no | Idempotency key for safe retries. Generated when omitted. |
--rule-key <value> | yes | Rule key. |
--display-name <value> | yes | Display name. |
--description <value> | no | Description. |
--severity <value> | yes | Severity. |
--spec <value> | yes | Spec. |
--channels <value> | no | Channels. |
--escalation-after-hours <value> | no | Escalation after hours. |
--mute-until <value> | no | Mute until. |
--scope <value> | no | Scope. |
--created-by-actor-type <value> | no | Created by actor type. |
--status <value> | no | Status. |
--expected-version <value> | yes | Expected version. |
Example
kf alert upsert-rule --tenant tnt_demo --actor-type USER --actor-id usr_sam --rule-key <value> --display-name <value> --severity <value> --spec <value> --expected-version <value>