Where alerts come from
- RMM critical alerts — NinjaOne, Atera, and other connected RMMs. Severities: critical, warning, info. Vectis defaults the customer hub to showing critical only, but the filter is per-user.
- Backup failures — Datto BCDR, Keepit, and Veeam VSPC. Each failed run becomes a
backup-job-failurealert with the failure reason + last-success timestamp inline. - Security posture — EDR / firewall / disk encryption / patch state per agent (sourced from RMM metadata).
- License drift — distributor seat counts not matching your PSA contract. These show up as alerts on the Money Found surface, not the customer hub.
Deduping across providers
A single failing device often fires in multiple systems — NinjaOne’s monitor sees the disk fill, Datto’s backup fails, the customer’s antivirus screams. Vectis collapses these into one alert thread per device + condition so your dispatcher sees one row, not three.
The collapse rules are deterministic:
- Same customer + same device + same condition class within a 30-minute window → one row.
- Same customer + same device + same source within an hour → one row.
- Otherwise → separate rows.
Acknowledging and resolving
From a customer hub or the global alert detail panel, you can:
- Acknowledge — Vectis writes the acknowledgement back to the originating RMM. The alert stays visible but moves to the “Acknowledged” sub-list.
- Resolve — closes the alert in the originating RMM. Available for vendors whose public API supports it (NinjaOne yes; Atera no — Atera’s alert API is read-only).
- Open as ticket — creates a PSA ticket linked to the alert. The ticket carries the alert ID + the triggering record so it’s one click back.
- Mute — silences alerts matching this condition for this customer for N hours. Useful during planned maintenance.
Wiring alerts into rules
The most common rule in a Vectis workspace is “RMM critical alert with no open ticket → create ticket”. Walk through it under Rules engine.
Other useful templates:
- Critical alert during business hours → page on-call
- 3+ alerts on same device in 24h → escalate
- Backup failure 3 runs in a row → notify customer + open ticket
- Security-posture flag (encryption disabled) → open ticket
Alert volume tells you about your environment, not just your workload. The Reports section has alert-volume-by-customer + alert-volume-by-device cuts that surface noisy environments worth a hardware refresh or configuration audit.