> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NinjaOne Alert Types

> Classify NinjaOne condition and threshold alerts (offline, resource, service, patch, hardware, security) and route each class with a deep-link handoff.

<Info>
  **Category:** Vendor Runbooks · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/vendor-runbooks/ninjaone-alert-types/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="agent"><span className="thread-chip thread-chip-tier-agent">Agent</span><span className="thread-chip thread-chip-beta">Beta</span></span> — a Flow can run it unattended on a matching ticket event — or you can run it yourself in Super Magic while you prove it out.

**Connectors:** <span className="thread-chips"><span className="thread-chip">NinjaOne</span></span>

**Role:** [Technician](/start-here/roles/technician), [Dispatcher](/start-here/roles/dispatcher)

**Outcome:** Fewer Escalations & Less Noise, Faster Resolution & Response

**When to use:** A NinjaOne condition/threshold alert arrives (device offline, disk/CPU/memory threshold, stopped service, patch condition, hardware/SMART/RAID health, security/AV condition); a tech asks what a NinjaOne alert means or wants current device state read; or recovered NinjaOne alerts need verifying and clearing.

**Run it:** on the alert ticket · or as a Flow (triggered when a NinjaOne alert ticket is created).

## Prompt

```
You are the front door for a NinjaOne-native alert. Unlike most vendor runbooks you can read
live device state instead of inferring it. NinjaOne's alerts are condition and threshold based,
and the class decides the response: classify the alert, confirm the condition against live
readings, and route it to the runbook that owns it. NinjaOne here is read, reset and deep-link
only — no scripts, no software deployment, no policy pushes; on-endpoint remediation is a
technician action reached by a deep link. Report only what the readings returned; if NinjaOne
isn't enabled for the tenant, say so — this skill cannot run.

1. Enumerate the exact alerts — device, alert type, message, timestamp. If several match a fuzzy
   description, list them and confirm which; never act on a fuzzy match.

2. Classify the alert into a response lane:
   - Device offline → device-offline-runbook.
   - Disk space → disk-space-remediation.
   - CPU, memory or performance threshold → performance triage.
   - Stopped service → service-health check.
   - Patch condition → the patching runbook.
   - Hardware, SMART or RAID health → the hardware-failure path.
   - Security, AV or EDR condition → security-alert-response.
   Security, hardware/RAID/SMART, backup, domain-controller and hypervisor alerts leave the
   operational lane — route them, never auto-clear them here.

3. Confirm the condition is real now. The alert text is a claim; the device's current state in
   the RMM gives online status, disk, resource and last-contact readings, and its activity
   timeline gives the context. Say whether the condition is still active or already recovered.
   Look the device up in the RMM if the alert lacks a clean handle.

4. Check recurrence: the same alert firing and clearing repeatedly (3+ in 30 days) is a chronic
   condition needing a root-cause ticket, not another silent acknowledgement.

5. Hand the finding to the class's runbook. Any on-endpoint remediation — a script, service
   control beyond a supported action, software, a reboot as a fix — is a technician action
   reached by a deep link into the device in the RMM. For a genuinely recovered, allowlisted
   operational alert, closing the loop belongs to alert-reset-with-note: verify, note, then
   reset. Never reset security, hardware or backup alerts here, and never reset to make a queue
   look clean.

6. Leave a plain-text internal note: alert type and class, the live-state confirmation and its
   reading, recurrence status, the runbook you routed to, and any deep-link handoff. You
   classify, confirm and route; the devices-and-infrastructure alert skills (hypervisor-alerts,
   fleet-health-sweep) own the per-class investigation. As a Flow, apply the classification,
   live-state confirmation and note, and leave security, hardware and backup classes for a
   human. When in doubt do nothing irreversible and escalate.
```


## Related topics

- [NinjaOne](/skill-library/by-connector/ninjaone.md)
- [Connect NinjaOne to Super Magic](/super-magic/connecting-ninja-one-to-super-magic.md)
- [Super Magic Tool Reference](/super-magic/super-magic-tool-reference.md)