Alert storms

Understand and read storms: groups of correlated alerts sharing a common root cause.

What it's for

An alert storm groups together several alerts that occurred almost simultaneously and were determined to share a common root cause. Rather than drowning you under dozens of independent notifications (e.g. during a network outage that makes all of a site's checks fail), SecuMon correlates them into a single storm. This reduces noise and highlights the real problem.

Storms are read-only: they are produced automatically by correlation. You consult them to understand the scope and origin of an episode.

The storm model

Field	Type	Description
`id`	uuid	Unique identifier.
`started_at`	date	Start of the storm.
`resolved_at`	date	End of the storm (absent if still active).
`duration_sec`	integer	Duration in seconds (if resolved).
`total_alerts`	integer	Total number of grouped alerts.
`affected_hosts`	integer	Number of affected hosts.
`affected_checks`	integer	Number of affected checks.
`root_cause_type`	string	Type of root cause identified (if available).
`root_cause_desc`	string	Description of the root cause (if available).
`confidence`	number	Confidence level of the correlation (0 to 1).
`status`	string	`active` (in progress) or `resolved`.

Using it from the portal

The Storms section shows the active storms and the history of resolved storms. For each one, you see its duration, the number of alerts, the affected hosts and checks, and — when available — the identified root cause with its confidence level.

Read-only, accessible to all roles.

Using it through the API

GET /api/v2/storms?active=true — without the parameter, the last 100 storms are returned in descending order of start; with active=true, only the storms still in progress (resolved_at absent) are returned.

curl -s "https://api.secumon.secuaas.ovh/api/v2/storms?active=true" \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "count": 1,
  "storms": [
    {
      "id": "e1e2e3e4-1234-4abc-9def-aabbccddeeff",
      "started_at": "2026-06-23T11:58:00Z",
      "total_alerts": 14,
      "affected_hosts": 3,
      "affected_checks": 9,
      "root_cause_type": "network",
      "root_cause_desc": "Loss of connectivity to the 10.0.0.0/24 segment",
      "confidence": 0.88,
      "status": "active"
    }
  ]
}

A resolved storm includes resolved_at and duration_sec, and its status is resolved.

How to read a storm

High total_alerts + low affected_hosts: a single host generating many alerts (e.g. all of its checks fail at the same time).
High affected_hosts: a cross-cutting problem (network, DNS, shared dependency) affecting several hosts — the root cause is probably upstream.
High confidence: the correlation is reliable; the proposed root cause deserves to be handled first.
Low confidence: treat the root cause as a lead, to be confirmed.

Use cases

On-call triage: faced with a burst of alerts, open the active storm to identify the scope and probable cause at once, instead of analyzing each alert in isolation.
Post-mortem: the storm history provides the chronology and scope of a major incident (duration, number of affected hosts).

Tips

Watch the dashboard's active_storms counter (GET /status): an active storm signals an ongoing episode that deserves immediate attention.
Cross-reference a storm with the incidents open on the same hosts to confirm the root cause.