Many teams make the mistake of enabling every available alert at once, only to overwhelm technicians with noise, flood the PSA with low-value tickets, and lose trust in the alerting system entirely.

Building a clean alert baseline helps your team take a controlled, operationally mature approach to alerting. Instead of routing everything directly into production workflows on day one, Liongard allows you to start small, validate which alerts actually matter, tune rules over time, and gradually operationalize alerts across your environments.

This approach helps MSPs create a scalable alerting strategy built around real operational value, not alert volume. The result is cleaner workflows, more actionable alerts, improved technician trust, and a stronger foundation for automation as your environments grow.

Actionable Alerts turn Liongard data into real, trackable work for your team.

Instead of manually checking dashboards or digging through environments to identify issues, Liongard continuously monitors for changes and routes alerts to the appropriate destination — whether that’s your PSA, Microsoft Teams, email, or Liongard itself.

Alerts can automatically open, update, close, and reopen based on changes detected in the source system, helping reduce manual oversight and duplicate work.

Templates also allow alerts to be routed by operational function. Security alerts can route to a SOC board, operational issues to the service desk, and lower-priority hygiene alerts to separate queues to help reduce unnecessary PSA noise.

Actionable Alerts also support Change Detection, showing before-and-after diffs between inspection runs to improve troubleshooting, root-cause analysis, and audit visibility.

Before routing alerts into your PSA, begin by sending alerts only into Liongard itself.

This creates a safe testing and validation layer where your team can:

This helps prevent unnecessary ticket volume from reaching production workflows too early.

Go to:

Admin → Actionable Alerts → Templates → New Template

Or clone an existing template.

Configure:

Assign the template to target environments under:

Admin → Actionable Alerts → Environments

If using PSA routing later, confirm each Environment already has a valid PSA mapping.

Avoid enabling every alert immediately. Instead, begin with a smaller set of operationally important alerts across core systems.

As a best practice, many MSPs begin with approximately 10–20 high-priority alerts before expanding further.

As alerts begin triggering under “Liongard Only” routing, review each alert carefully.

Questions to ask:

Keep the alert enabled: If the alert consistently identifies operationally meaningful issues.
​

Disable noisy or redundant alerts: If the alert creates unnecessary operational noise or duplicates existing workflows.
​

Clone and tune alerts
Instead of modifying defaults directly, clone rules and adjust:

To clone a rule:

The goal is to build an alert baseline your technicians trust and consistently respond to.

Once alerts have been validated and tuned, move only the high-confidence alerts into PSA routing and automation workflows.

Many MSPs maintain:

Clone the baseline template and update:

Recommended routing examples:

If an alert has not been operationally validated, it should not yet be routed into the PSA.

Weeks 1–2:

Weeks 3–6:

Weeks 7–12:

Actionable Alerts work best when routing, exclusions, and silencing rules are planned intentionally.

Otherwise, it’s easy to create:

If the same rule exists across multiple templates, Liongard can route alerts differently depending on template configuration.

If destinations differ, multiple notifications may intentionally occur.

If the destination type is the same but boards or queues differ, Liongard prioritizes the template with the lowest order number to help prevent duplicate ticket creation.

RoarExclude allows teams to suppress alerts for specific accounts without disabling the rule entirely.

This is especially useful for:

Create a security group named:

RoarExclude

Then add accounts that should be excluded from supported user-related alerts.

Liongard also supports temporary silencing of rules or individual alerts.

This can help:

Once unsilenced, normal alert behavior resumes automatically.

As alerting maturity increases, many MSPs separate ownership by operational function instead of routing everything into a single shared queue.

Separate templates and routing workflows help ensure alerts reach the teams best equipped to respond quickly and consistently.

One MSP initially enabled more than 180 alerts across their environments, which quickly overwhelmed technicians and flooded the PSA with low-value tickets.

After shifting to a baseline-first strategy:

The partner later expanded this baseline strategy across additional client environments.

A properly tuned alerting strategy helps MSPs:

Actionable Alerts also provide documented visibility into operational changes across environments.

Environment timelines, alert comments, and Change Detection diffs can support:

This can help support operational and compliance conversations across frameworks such as CIS v8, HIPAA, SOC 2, and NIST.