Hi @anilchaithu  thanks for the thoughtful reply. I love this idea, and have currently been adding the search parameters to the email action but was thinking of adding a separate search parameter as a follow up. E.g Alert triggered (Your service is unfire!) separate report triggers that shows the HTTP status codes for the past hour. (Just to see how unfire it really is in comparison) hmm I am curious on the second option you provided: | rest /services/alerts/fired_alerts Does this sound offbase? Imagine I made a search that was: index=ABC source=X |timechart count by status then added  | rest/services/alerts/named_alert E.g  index=ABC source=X |timechart count by status|rest/services/alerts/named_alert   I would get the email with the timechart of status when "named_alert" triggers?   ... View more