How to Route Alerts to Slack and Turn Them Into Tickets

What's in the demo

• The Alerts page for one client (Acme Manufacturing): Active Alerts 6, counted by severity (1 critical, 1 high, 3 medium, 1 low), each row showing the device, what tripped and how long ago
• The critical alert, "Disk usage above 90% on C: (93.5%)" on the file server ACME-SRV-02, opened to its full message ("Volume C: has 121 GB free of 1.8 TB. Threshold: 90%.") and device
• Alerts → Monitors: the built-in "Disk almost full" monitor (badged Built-in and Partner-wide), threshold lowered from 90 % to 85 %, saved, then "Test on a device" → "Condition met on ACME-SRV-02"
• Alerts → Delivery → New Channel: scope "This organization only", named "Acme Ops — NOC Slack", type Slack, an incoming-webhook URL and the #acme-noc channel. The type grid also offers Email, Microsoft Teams, PagerDuty, Webhook, SMS and Pushover
• A new routing rule, "Acme Ops — Critical & high to Slack": this organization only, priority 10 (lower runs first), severities Critical and High, any monitor kind, sent to the new Slack channel. It sits above the "Everything else" row, which catches whatever no rule matches
• "Test this rule set": severity Critical, monitor kind Disk usage → "Critical → Acme Ops — NOC Slack", with the deciding rule named ("Organization rule: Acme Ops — Critical & high to Slack"). The preview sends nothing
• Escalation policies, mentioned only: a policy sends follow-up notifications while an alert stays unacknowledged (none is set up in the demo)
• Back on the alert: Acknowledge (it stays open, now marked Acknowledged with who and when), then Create ticket
• The new ticket in Service Desk, T-2026-0133 "Disk usage above 90% on C: (93.5%)": priority Urgent, type Incident, source Alert, device ACME-SRV-02, the alert's message as the description, a "Linked alert" line, and SLA timers (first response 1h, resolution 4h)
• Resolve the alert with a note naming the ticket ("…Work logged on T-2026-0133."): the row reads Resolved and Active Alerts drops from 6 to 5

Questions this video answers

What does Breeze RMM monitor out of the box?

Breeze ships built-in monitors for CPU, memory, disk, patch compliance and hardware health. You find them under Alerts → Monitors, retune their thresholds there (the demo lowers "Disk almost full" from 90 % to 85 %), and switch them on per client by deploying them through a configuration policy. "Test on a device" checks a monitor against a real device before you rely on it.

Can Breeze RMM send alerts to Slack or Microsoft Teams?

Yes. Add a delivery channel under Alerts → Delivery. Slack and Teams use an incoming-webhook URL, and Email, PagerDuty, generic webhooks, SMS (once Twilio is configured on your server) and Pushover are set up the same way. A new channel stays quiet until a routing rule points at it. Routing rules match by severity, monitor kind and site, run lowest priority number first, and fall through to an "Everything else" row. "Test this rule set" shows where a given alert would land, and which rule decided it, without sending anything.

Can an RMM alert become a ticket in Breeze RMM?

Yes. Open the alert and click Create ticket. Breeze opens a Service Desk ticket pre-filled from the alert: its title as the subject, its message, the device, source Alert, a linked-alert line, and a priority taken from the severity (critical → Urgent). It is a click a technician makes. There is no rule today that turns alerts into tickets automatically.

Does Breeze RMM escalate alerts nobody acknowledges?

Yes. An escalation policy, set under Alerts → Delivery and chosen on a routing rule, re-notifies channels or people on a schedule while the alert stays unacknowledged. Acknowledging the alert stops it. The demo mentions escalation policies but doesn't build one.

Does resolving the alert close the ticket?

No. The alert and the ticket are separate records, and you close each one yourself. In the demo the resolution note names the ticket number, so the alert's record points at the ticket that holds the work.