Alerting and on-call
Channels
Section titled “Channels”Push (native iOS app and Apple Watch) and email are available on every plan. Personal SMS is included from Pulse. On-call SMS and phone calls are included from Sentinel as escalation steps to verified numbers. Successful personal and on-call SMS and voice deliveries share the monthly and rolling 24-hour quotas on plans and limits. The full channel table is on alerting and integrations.
The live display
Section titled “The live display”An open incident puts a live display on the phone it woke: on the lock screen, in the Dynamic Island, on an Apple Watch in the Smart Stack, and on the CarPlay dashboard. Lay the phone on its side on a charger and it fills the screen, readable from across the room.
It follows the situation rather than the moment it appeared: how many incidents are open, how bad the worst of them is, which service, and how long it has been running. Once somebody takes a case, the display on every other phone stops offering to take it.
With exactly one incident open, it carries Acknowledge, and the case is taken straight from the lock screen without unlocking. With several open, you pick the case in the app, so the acknowledgment always lands on the incident you mean. On the watch and in CarPlay, the live display keeps you informed, and you acknowledge in the app or by voice.
Apple ends a live display a few hours after it begins. The escalation runs independently of it: the display is the quiet view beside the alarm.
Acknowledging by voice
Section titled “Acknowledging by voice”Somebody woken at three in the morning has the earbuds in and the phone somewhere across the room. Acknowledging is the one act that counts in that minute, because it stops the ladder before it wakes the next colleague. By voice, it works without finding a device and unlocking it.
Say “Acknowledge the incident in Perstat” or “Take over the incident in Perstat”. With exactly one case open, it is taken, no question asked. With several open, Siri asks which one and offers the service names, so the right case gets its owner. With nothing open, Siri says that too.
The outcome is spoken, the failure as well. Somebody who says “acknowledge” at night, hears “taken over” and turns over is relying on that word.
Voice acknowledgment works on the locked phone, so it counts in exactly the minute it matters. Anyone with physical access to an on-call phone can therefore stop a running escalation. If your policy rules that out, turn off Siri on the locked device under Settings, then Face ID & Passcode, then Siri when locked.
The built-in phrases are English and German. In the Shortcuts app, you can give the action a wording of your own, in whichever language your Siri speaks.
The escalation ladder
Section titled “The escalation ladder”An incident pages the on-call person by push first. Without an acknowledgment, the ladder moves on to SMS and then to a phone call, with stage timings configured per schedule. Calls are capped at 2 per incident: escalation should wake a human, not drain a battery.
The chain itself is yours to define, under On-call in the Escalation chain section. Every step has a moment (immediately, or after X minutes), its recipients, and its channels. Add and remove steps as you need. Without any change, you keep the two-stage chain defined by the schedule’s delays.
A step reaches several recipients at the same time. “After 15 minutes the owners and the team lead and the Slack channel” is one step with three targets, not three steps. A target is whoever is on duty, a specific person, a role, owners and admins, or an endpoint: any connector you set up under Integrations (Slack, Microsoft Teams, Discord, Google Chat, PagerDuty, Opsgenie, or a signed webhook of your own).
Channels can be set per recipient. A step names the channels its people are reached on, and that is the setting most chains ever need. Where one recipient should be reached differently, the step’s card carries a small as the step control next to that recipient: switch it, and this one recipient is paged the way you chose while everybody else on the same rung keeps the step’s setting. So “at minute 15 call the person on duty, and push the second level” is one step, not three steps at three artificial minutes. An endpoint has exactly one way in and ignores channels entirely, on the step and on itself.
The grid above the steps shows the channels that actually go out, rather than the step’s default: if every recipient of a rung overrides it, the rung shows what those recipients get.
Because a step already holds several recipients, each step has its own minute. Perstat refuses to save two steps at the same minute, since only one of them would go out.
Above the steps, the chain is drawn as a grid: the trigger on top, the steps below it in the order of time, and beside each step its fan of recipients. It shows at a glance what a list cannot, namely how many people one step wakes at once. You edit in the cards underneath, and the grid serves as the map.
An endpoint that is switched off or failed on its last delivery is marked right at the step, with the reason, so every rung shows whether it reaches its target.
An endpoint that a step alerted also receives the all-clear, even when it is not subscribed to that event under Integrations. This matters most with PagerDuty and Opsgenie: naming an endpoint in a step opens an alert there, and an alert that is never closed keeps ringing after the incident is over. What the chain opens, the chain closes.
Two rules apply to every chain: an incident that has been open for a long time lands on the latest due step instead of walking the chain from the start, and if nobody is on duty, the end of the chain applies immediately. An escalation never waits on a timer that reaches nobody.
Phone number verification
Section titled “Phone number verification”Every number is verified before it can be paged: a 6-digit one-time code, valid for 10 minutes, with a 60-second resend cooldown and at most 5 attempts. Paging goes to verified numbers exclusively.
What acknowledging does
Section titled “What acknowledging does”Acknowledging an incident takes ownership: the escalation stops, every other device quiets down, and reminders go to the owner rather than the whole team. The acknowledgment, like every event, lands on the incident timeline with its timestamp.
Snooze
Section titled “Snooze”Snoozing is the smaller, personal gesture. It silences an incident for 15 minutes and for you alone. Everybody else keeps hearing it, the escalation continues, ownership stays open, and the timeline records no decision.
Snooze when you already know and are on your way to a laptop, and acknowledge when you are the person handling it. Snoozing where an acknowledgment belongs leaves the team believing an incident is unowned. Acknowledging where a snooze belongs stops the escalation for everyone.
A snooze affects the person who asks for it, so it needs no particular role: whoever can be woken by an alert can quiet their own phone.
Dependent alarms
Section titled “Dependent alarms”When one failure causes ten, you want one alarm and not ten. A monitor can name the monitors it depends on, and while one of those origins is provably down, this monitor holds its alarm chain rather than adding to the noise.
Set it on the monitor that would be woken for, not on the origin. The rule is a list of 1 to 20 origin monitors plus a deadline between one minute and 24 hours.
The rule holds the alarm chain and keeps everything else running:
| Held | The alarm chain: push, SMS, phone call, the escalation ladder |
| Continues as usual | The incident itself, its start time, downtime, the SLA record, the status page, and status-page subscribers |
The incident opens exactly as it otherwise would. Your public page and its subscribers stay consistent, because outward notification continues, and only the wake-up inside your team waits.
Three properties keep every held alarm accounted for:
- Loud in every case of doubt. The alarm is held only when the failure of an origin can be positively established. No rule, an unreachable origin, a failed lookup, or an origin that is up or merely unknown all mean loud.
- A deadline that always exists, counted from the start of the incident rather than from now. Once it passes, the alarm goes loud regardless of what the origin is doing. Counting from the incident start keeps a flapping origin from extending the silence indefinitely.
- Visible while it is held. A held alarm shows in the notification bell with who is holding it and until when, so a held alarm is always distinguishable from a lost one.
A monitor that names itself as an origin alarms normally, so a service can never suppress its own alarm.
On-call schedules
Section titled “On-call schedules”Rotations with escalation stages and a coverage-gap warning when nobody is on duty. On-call, like incident command, is included from Sentinel, and the exact gates are on plans and limits.
Alerts follow an explicit rule
Section titled “Alerts follow an explicit rule”A configured policy decides whether you get woken up, so every alarm traces back to a rule you can read. For the eleven regional probe types, the policy confirms the failure across regions, two by default. Agent and heartbeat monitors follow their own incoming-signal rules. The quorum rule explains the regional mechanism.
- Incidents and post-mortems: what happens once someone owns the incident.
- Signed webhook: connect your own incident tool to the chain.