Threshold rules

Threshold is the most common rule type. It fires when a metric value crosses the given threshold.

Fields

metric — a bare metric name or full PromQL
filters — mandatory matchers (organization_id is always injected automatically)
comparator — > < >= <= == !=
threshold — a numeric value
for_duration_seconds — flapping protection (0 = immediately)
severity — critical/warning/info

metric: system_cpu_usage_percent
filters: {role: "web"}
comparator: >
threshold: 80
for: 60s
severity: warning

Fires when CPU > 80% on hosts with label role=web continuously for 60 seconds.