Overview

Remediation rules watch incoming RMM alerts. When an alert matches a rule's conditions, its actions run automatically - seconds after the alert arrives, whether or not anyone is at a desk.

Conditions

Each rule has one or more conditions over alert and asset fields (alert type, category, severity, hostname, plan, and more) using is, is not, and contains operators. All conditions must match for the rule to fire, so rules can be as narrow as one noisy service on one customer's fleet.

Actions

• Run a script from your script library on the affected device.
• Create a ticket under the asset's customer, pre-linked to the device.
• Send an email to your team.
• Resolve the alert automatically (useful for known-noise alerts).

Safety Rails

• Each rule fires once per alert - re-occurrences of the same alert don't re-trigger it.
• A per-asset daily cap prevents a misbehaving machine from burning through unlimited automated actions.

Example Rules

• Disk space alert on any server → run the disk-cleanup script and email the team.
• Malware detected → create a high-priority ticket immediately.
• Backup failed → create a ticket so the failure never slips by.