# Use per-alert fields when an Alertmanager group has mixed labels

> A common-label shortcut can omit the very instance detail a responder needs.

- Canonical URL: https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:37+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A common-label shortcut can omit the very instance detail a responder needs.

## Potentially affected

Review group-level and individual-alert data used by Alertmanager notification templates.

## DSE recommendation

DSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details.

## Article

A common-label shortcut can omit the very instance detail a responder needs.

## Source facts

Alertmanager notification data includes Alerts, GroupLabels, CommonLabels, and CommonAnnotations. Common fields contain only values shared across the group, while individual alert objects retain their own labels and annotations. The template reference also distinguishes currently firing from resolved alerts. Templates therefore need to handle group-level and per-alert information deliberately.

Source: [Prometheus documentation — Notification template reference](https://prometheus.io/docs/alerting/latest/notifications/).

## Applicability

Review group-level and individual-alert data used by Alertmanager notification templates.

## DSE recommendation

DSE recommends putting shared incident context in the group heading and iterating individual alerts for instance-specific details. Do not assume a hostname, service, or remediation link is common merely because a small test group happened to share it. Make resolved and firing state easy to distinguish, and keep the notification concise enough for the delivery channel. Avoid including confidential label values or internal credentials in messages sent to external integrations. Maintain representative grouped examples with the template change.

## Verification

Render the template against a test group containing different instance labels, mixed annotations, and both firing and resolved alerts. Inspect the actual target channel’s result, including escaping and links. Confirm no affected instance disappears because a field was absent from CommonLabels, and verify a single-alert group remains readable. Retain the rendered output beside the synthetic input group. Ask an on-call reviewer to find each distinct instance and its state without consulting the source payload, then resolve any missing or ambiguous detail before template release.

## Official reference

[Prometheus documentation — Notification template reference](https://prometheus.io/docs/alerting/latest/notifications/). Reviewed October 20, 2026.

## Primary reference

- Name: Prometheus documentation — Notification template reference
- Authority: prometheus.io
- URL: https://prometheus.io/docs/alerting/latest/notifications/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use per-alert fields when an Alertmanager group has mixed labels,” DSE Security, https://update.dsesecurity.com/updates/use-per-alert-fields-when-an-alertmanager-group-has-mixed-labels/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.