Triage views: rule status, alerts by case, blast radius

• Rule status page (M2). Alerts > Rules > "Status of <rule>" (/alerts?tab=rules&rule_status=<id>) shows the rule definition and threshold, a live preview graph, the alerts the rule opened and the state history of its evaluations over the last 6 hours (GET /alert-rules/{rule}, /evaluations).

• Inbox grouped by case (M6). Tick "Group by case" in the Alerts inbox filters. Open cases (50 most recent) and their alert links (/cases, /cases/{case}/links, the links auto-case rules create) roll related alerts under one header with the case number, priority and a link to it; alerts with no case follow under "No case". Select a group or single alerts, then Ack, Resolve, Snooze 1 h, Silence, or "Assign cases to me" (PATCH /cases/{case}). Each action runs per alert and failures are listed. Alerts that a correlation rule grouped (GET /correlation-cases, each case keeps its alert ids) roll up the same way, so related alerts collapse into one work item without writing an auto-case rule; a correlation group has no assignee or page, so "Assign cases to me" skips it.

• Blast radius on the infrastructure map (M8). Infrastructure > Topology has a "Highlight blast radius of" picker over firing alerts. It fetches /alerts/{id}/blast-radius and draws the alerting service red and its callers amber on the service nodes. The blast radius lists services, not hosts, so hosts are not highlighted.

Silences

POST /v1/projects/{prj}/silences takes matchers (1 to 20 of {"name", "op", "value"}, op one of eq, ne, re, nre), ends_at (RFC 3339), and optionally starts_at (RFC 3339, default now) and comment (also accepted as name).

POST /v1/projects/{prj}/silences:preview takes only matchers: it has no starts_at or ends_at, and any other field is rejected. It answers matching_now (open alerts the matchers match), matching_7d (alerts open at any time in the last 7 days that they match) and up to 100 samples of {alert_id, labels}.