Trigger workflows on threshold breach
When an ongoing monitoring metric breaches its threshold, you can start a workflow automatically in addition to the email alert notifications stakeholders already receive.1 This lets remediation, review, or escalation begin without anyone having to notice the alert first.
Because the workflow starts from a metric logged against an inventory record, this trigger is available for record workflows only.
Prerequisites
Set up the trigger
Add a record workflow5 and under Workflow Start, select On Monitoring Threshold Breach. Then choose which metrics the workflow watches:
| Option | Description |
|---|---|
| Any metric breach | Enabled by default. The workflow starts when any ongoing monitoring metric on the record breaches its threshold. |
| Specific metrics | Disable Any metric breach, then select one or more metrics under Metrics to monitor. The workflow starts only for the metrics you select. |
The Metrics to monitor list offers the metrics already logged by records in your organization, along with metrics included in a monitoring template. Metrics that appear because they are in a template but have no readings yet are marked as not yet recorded — you can still select one, and the workflow starts once that metric is logged and breaches.
When the workflow starts
The workflow starts when a metric enters a breached state, that is when a metric is logged with passed=False and the previous reading for that same metric on that same record was not already failing.
This means:
- A metric that goes from passing to failing starts the workflow.
- The first reading ever logged for a metric starts the workflow if it is already failing.
- A metric logged as failing again, having already failed, does not start the workflow a second time. A monitoring job that runs hourly and keeps reporting the same breach starts one workflow, not one per run.
- A metric returning to passing and later failing again starts the workflow again.
The trigger reads the passed parameter you set and does not re-evaluate your thresholds. A metric that defines thresholds but never sets passed does not start a workflow, in the same way that it does not send an alert notification.6
Review the breach that started a workflow
For a workflow started by a breach, the execution details show which reading was responsible:
- The metric name and the value that breached
- The thresholds defined for that metric
- When the reading was recorded
- A link to the record’s monitoring document
Include breach details in notifications
A Broadcast step7 in a breach-triggered workflow can include the breach in the email it sends, so recipients know which metric is at fault without opening the record first. When the workflow uses this trigger, these variables become available under Monitoring Breach:
| Variable | Description |
|---|---|
| Breached Metric Name | The metric that breached, named as it appears when you select it: its display name followed by its full key, unless the two are the same. Two metrics can share a display name, so the key is what tells them apart. |
| Breached Metric Key | The full key of the metric, as logged. |
| Breached Metric Value | The value recorded for the breaching reading. |
| Breached Metric Thresholds | The thresholds defined for that metric. |
| Monitoring Document URL | A link to the record’s monitoring document. |
Since these variables can be resolved only for a workflow started by a breach, they are offered for this trigger only. For the same reason, once a broadcast message uses one of them, you cannot change the workflow’s start trigger to something else — the save is rejected and names the variable to remove or replace first.
What a breach sends
The alert email and the workflow follow different rhythms, so it is worth knowing what a breach produces before you add a Broadcast step to a breach-triggered workflow:
- The alert email is sent for every breaching reading.8 A metric that keeps failing keeps sending it.
- The workflow starts only on the transition into breach. A metric that was already failing does not start it again.
One person can therefore receive three things for a single breach: the alert email, the broadcast email your workflow sends, and the in-app broadcast notification.
To reduce that, a Customer Admin can turn off Monitoring breach or Broadcast notifications under Settings.9 Two limits are worth knowing: the toggles apply to your whole organization rather than to a single record or workflow, and they suppress emails only — the in-app notification is unaffected.