{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
        "slug": "use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels",
        "url": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/"
        },
        "title": "Use per-alert fields when an Alertmanager group has mixed labels",
        "summary": "A common-label shortcut can omit the very instance detail a responder needs.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:37+00:00",
        "modified_at": "2026-10-20T18:34:33+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 254,
        "potentially_affected": "Review group-level and individual-alert data used by Alertmanager notification templates.",
        "dse_recommendation": "DSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details.",
        "primary_source": {
            "name": "Prometheus documentation — Notification template reference",
            "url": "https://prometheus.io/docs/alerting/latest/notifications/",
            "published_on": null,
            "authority": "prometheus.io"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A common-label shortcut can omit the very instance detail a responder needs.</p>\n<h2>Source facts</h2>\n<p>Alertmanager notification data includes Alerts, GroupLabels, CommonLabels, and CommonAnnotations. Common fields contain only values shared across the group, while individual alert objects retain their own labels and annotations. The template reference also distinguishes currently firing from resolved alerts. Templates therefore need to handle group-level and per-alert information deliberately.</p>\n<p>Source: <a href=\"https://prometheus.io/docs/alerting/latest/notifications/\">Prometheus documentation — Notification template reference</a>.</p>\n<h2>Applicability</h2>\n<p>Review group-level and individual-alert data used by Alertmanager notification templates.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details. Do not assume a hostname, service, or remediation link is common merely because a small test group happened to share it. Make resolved and firing state easy to distinguish, and keep the notification concise enough for the delivery channel. Avoid including confidential label values or internal credentials in messages sent to external integrations. Maintain representative grouped examples with the template change.</p>\n<h2>Verification</h2>\n<p>Render the template against a test group containing different instance labels, mixed annotations, and both firing and resolved alerts. Inspect the actual target channel’s result, including escaping and links. Confirm no affected instance disappears because a field was absent from CommonLabels, and verify a single-alert group remains readable. Retain the rendered output beside the synthetic input group. Ask an on-call reviewer to find each distinct instance and its state without consulting the source payload, then resolve any missing or ambiguous detail before template release.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://prometheus.io/docs/alerting/latest/notifications/\">Prometheus documentation — Notification template reference</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A common-label shortcut can omit the very instance detail a responder needs.\nSource facts\nAlertmanager notification data includes Alerts, GroupLabels, CommonLabels, and CommonAnnotations. Common fields contain only values shared across the group, while individual alert objects retain their own labels and annotations. The template reference also distinguishes currently firing from resolved alerts. Templates therefore need to handle group-level and per-alert information deliberately.\nSource: Prometheus documentation — Notification template reference.\nApplicability\nReview group-level and individual-alert data used by Alertmanager notification templates.\nDSE recommendation\nDSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details. Do not assume a hostname, service, or remediation link is common merely because a small test group happened to share it. Make resolved and firing state easy to distinguish, and keep the notification concise enough for the delivery channel. Avoid including confidential label values or internal credentials in messages sent to external integrations. Maintain representative grouped examples with the template change.\nVerification\nRender the template against a test group containing different instance labels, mixed annotations, and both firing and resolved alerts. Inspect the actual target channel’s result, including escaping and links. Confirm no affected instance disappears because a field was absent from CommonLabels, and verify a single-alert group remains readable. Retain the rendered output beside the synthetic input group. Ask an on-call reviewer to find each distinct instance and its state without consulting the source payload, then resolve any missing or ambiguous detail before template release.\nOfficial reference\nPrometheus documentation — Notification template reference. Reviewed October 20, 2026.",
        "content_markdown": "A common-label shortcut can omit the very instance detail a responder needs.\n\n## Source facts\n\nAlertmanager notification data includes Alerts, GroupLabels, CommonLabels, and CommonAnnotations. Common fields contain only values shared across the group, while individual alert objects retain their own labels and annotations. The template reference also distinguishes currently firing from resolved alerts. Templates therefore need to handle group-level and per-alert information deliberately.\n\nSource: [Prometheus documentation — Notification template reference](https://prometheus.io/docs/alerting/latest/notifications/).\n\n## Applicability\n\nReview group-level and individual-alert data used by Alertmanager notification templates.\n\n## DSE recommendation\n\nDSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details. Do not assume a hostname, service, or remediation link is common merely because a small test group happened to share it. Make resolved and firing state easy to distinguish, and keep the notification concise enough for the delivery channel. Avoid including confidential label values or internal credentials in messages sent to external integrations. Maintain representative grouped examples with the template change.\n\n## Verification\n\nRender the template against a test group containing different instance labels, mixed annotations, and both firing and resolved alerts. Inspect the actual target channel’s result, including escaping and links. Confirm no affected instance disappears because a field was absent from CommonLabels, and verify a single-alert group remains readable. Retain the rendered output beside the synthetic input group. Ask an on-call reviewer to find each distinct instance and its state without consulting the source payload, then resolve any missing or ambiguous detail before template release.\n\n## Official reference\n\n[Prometheus documentation — Notification template reference](https://prometheus.io/docs/alerting/latest/notifications/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
                "url": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Use per-alert fields when an Alertmanager group has mixed labels",
                        "item": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/#article",
                "identifier": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
                "url": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/",
                "headline": "Use per-alert fields when an Alertmanager group has mixed labels",
                "description": "A common-label shortcut can omit the very instance detail a responder needs.",
                "abstract": "A common-label shortcut can omit the very instance detail a responder needs.",
                "articleBody": "A common-label shortcut can omit the very instance detail a responder needs.\nSource facts\nAlertmanager notification data includes Alerts, GroupLabels, CommonLabels, and CommonAnnotations. Common fields contain only values shared across the group, while individual alert objects retain their own labels and annotations. The template reference also distinguishes currently firing from resolved alerts. Templates therefore need to handle group-level and per-alert information deliberately.\nSource: Prometheus documentation — Notification template reference.\nApplicability\nReview group-level and individual-alert data used by Alertmanager notification templates.\nDSE recommendation\nDSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details. Do not assume a hostname, service, or remediation link is common merely because a small test group happened to share it. Make resolved and firing state easy to distinguish, and keep the notification concise enough for the delivery channel. Avoid including confidential label values or internal credentials in messages sent to external integrations. Maintain representative grouped examples with the template change.\nVerification\nRender the template against a test group containing different instance labels, mixed annotations, and both firing and resolved alerts. Inspect the actual target channel’s result, including escaping and links. Confirm no affected instance disappears because a field was absent from CommonLabels, and verify a single-alert group remains readable. Retain the rendered output beside the synthetic input group. Ask an on-call reviewer to find each distinct instance and its state without consulting the source payload, then resolve any missing or ambiguous detail before template release.\nOfficial reference\nPrometheus documentation — Notification template reference. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:37+00:00",
                "dateModified": "2026-10-20T18:34:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Use per-alert fields when an Alertmanager group has mixed labels"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 254,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Prometheus documentation — Notification template reference",
                    "url": "https://prometheus.io/docs/alerting/latest/notifications/"
                }
            }
        ]
    }
}