Detect
Operational events
An operational event is an event that a provider or platform delivers about itself, identified by a definition identifier. MonitOps alerts on the events that are on a configured list of actionable definitions and keeps every other event as evidence.
How it works#
Events arrive from a configured source, for example through the provider's own event delivery. Each carries a definition identifier and an identity of its own at the source.
| Rule | Behaviour |
|---|---|
| Allowlist | A configured list maps each actionable definition to a severity, a recovery rule and an evidence rule |
| Immediate evaluation | An allowlisted event is evaluated directly. It does not wait for the event rate to become anomalous |
| Deduplication | Events are deduplicated by their source event identity, so a redelivered event is not counted twice |
| Unknown definitions | An event whose definition is not on the list stays as evidence. It raises nothing until a rule is configured |
The allowlist is expressed as an alarm definition of the operational event kind (see Alarm definitions). Like other definitions it is versioned, and each evaluation records the version that produced it.
Recovery#
An actionable-event rule states how it recovers: explicitly, through a recovery rule, or by an operator resolving it.
Events and cause assessment#
An event can be a feature of a cause assessment. The error signal feature rises when a new operational event definition appears, and an event counts as evidence that reopens the record it came from. See Cause assessment.
Events that arrive late#
Provider event log files that arrive after the event are lagging signals. They never raise alerts. They are attached to the incident as evidence, and the cause assessment is re-run once. See Source health.
What you see in the console#
An alert raised from an event carries the severity the allowlist maps. Events not on the list appear in the evidence for incidents in their window, not as alerts.
Limits and defaults#
- Only definitions on the list raise alerts.
- The list is an alarm definition, so changes to it are versioned.
Related#
Last updated October 2026