Escalation policies
Understand escalation policies, how alerts move through steps when no one acknowledges an alert.
What is escalation?
Escalation is the process of notifying progressively broader groups of people when an alert is not acknowledged within a configured time. Without escalation, a single alert goes to a single channel and nothing more happens if it is missed. With escalation, missed alerts automatically notify the next person or team.
Escalation policies are part of the On-call capability. You can create multiple policies on every plan, but the number of steps per policy is limited: the free plan allows up to 3 steps per policy, and the paid On-call plan removes the limit. External alert ingestion is free on all plans. The paid On-call plan (metered per active responder) adds SMS/voice paging and unlimited escalation steps — see pricing for current limits and rates.
Escalation policy anatomy
An escalation policy is an ordered list of steps. Each step defines:
-
Delay:
delay_minutes— how long to wait after the previous step fired before this step fires. Delays are cumulative down the list. The first step's delay is honored too: a non-zero delay on step 1 means no one is paged until that many minutes after the incident opens. -
Notification target: exactly one target per step. Choose one of:
Target Who it reaches User A specific person Notification channel A configured channel (Slack, email, PagerDuty, …) On-call schedule Whoever is on call on that schedule when the step fires Next / previous in rotation The person after (or before) the current on-call on a schedule Team The members (or admins) of a team Workspace owner The account owner — a safety net Broadcast Every enabled workspace channel at once
Example policy:
| Step | Delay (after previous step) | Fires at | Target |
|---|---|---|---|
| 1 | 0 min | T+0 (immediately) | Telegram to on-call engineer |
| 2 | 5 min | T+5 min | Slack to team lead |
| 3 | 10 min | T+15 min | Email to CTO + PagerDuty |
Because each delay is measured from the previous step, the delays add up: with delays of 0, 5, and 10 minutes the steps fire at T+0, T+5, and T+15. Step 1 fires immediately here only because its delay is 0 — if you set step 1's delay to 5 minutes, nobody is paged for the first 5 minutes after the incident opens, so keep the first step's delay at 0 unless you deliberately want that quiet period. Escalation stops advancing as soon as someone acknowledges.
There is no automatic "immediate" broadcast before step 1. If your first step has a non-zero delay, that is a window of silence right after the incident opens. Set step 1's delay to 0 to page immediately.
Repeat
Repeat is a policy-level setting, not a per-step one. When enabled, after the last step fires without an acknowledgement the whole policy restarts from step 1, and it keeps cycling until someone acknowledges (or the alert resolves). The gap between cycles is the policy's repeat interval (defaults to 30 minutes) — not the delay of step 1. Use it for critical policies that must nag until answered; leave it off to stop after the final step.
Alongside the policy steps, your personal notification chain runs in parallel and decides how you are reached. Each channel has a priority and a fallback_after_seconds delay, so a single page can fan out across channels over time, for example push now, email after 5 minutes, SMS after 10 minutes. The priority order and every fallback delay are configurable per channel.
Acknowledgement
Any team member can acknowledge an alert to stop the escalation chain from advancing. Acknowledgement methods:
- Dashboard: open the alert and click Acknowledge
- Telegram: tap the Acknowledge button in the alert message
- Discord: tap the Acknowledge button on the alert
- Slack: tap the Acknowledge button — available when Slack is connected via the OAuth "Add to Slack" install (buttons on manually-configured Slack incoming webhooks are inert)
- Email: click the Acknowledge link in the alert email
- Mobile app: acknowledge from the push notification or the app
| Action | What happens |
|---|---|
| Acknowledge | Escalation stops advancing. The alert stays open and visible until the monitor recovers or someone closes it. |
| Silence (N minutes) | A pause. Escalation and your personal chain both hold, then both resume when the window ends. |
| Unacknowledge | Re-arms escalation and your personal chain immediately. |
What happens after all steps complete
If every step fires and no one acknowledges:
- The escalation chain ends, no further notifications are sent.
- The alert remains open and visible in the dashboard.
- It will auto-resolve when the monitor recovers, or you can close it manually.
No further alerts are sent after the last escalation step. Make sure your policy includes enough steps and channels to reach someone responsible.
Assigning a policy to a monitor
One escalation policy can be assigned to many monitors, but each monitor can have only one policy at a time.
- Go to Monitors and open the monitor.
- Click Edit.
- In the Alerting tab, select the policy from the Escalation Policy dropdown.
- Click Save.
Monitors without an assigned policy use a broadcast: all configured notification channels are notified at once, with no escalation. Each channel still passes its own filters (per-channel events filter, quiet hours, and deduplication), so a channel can still be skipped.
Maintenance windows
Active maintenance windows suppress all alerts and escalations for the selected monitors. If an alert opens during a maintenance window, the escalation chain does not start.
Related
Was this page helpful?