Generating actionable alert messages for resolving incidents in an information technology environment

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

• identifying a notable event from data reflecting operation of computing devices in an information technology (IT) environment, wherein the notable event is identified based on a notable event definition, and wherein the notable event is associated with a notable event type;
• generating an invokable action message, wherein the invokable action message includes information based on an invokable action message definition associated with the notable event type, wherein the invokable action message definition identifies at least a first recipient and a second recipient of the invokable action message;
• sending the invokable action message to a first computing device associated with the first recipient, wherein the invokable action message causes the first computing device to display a user interface including an interface element corresponding to an invokable action associated with the invokable action message;
• determining that a period of time has elapsed without a response from the first computing device associated with the first recipient;
• responsive to determining that the period of time has elapsed, sending the invokable action message to a second computing device associated with the second recipient;
• receiving, from the second computing device, an action invocation message associated with the invokable action;
• and
• executing the invokable action.

A system comprising:

• a first one or more electronic devices to implement a data intake and query system, the data intake and query system including instructions that upon execution cause the data intake and query system to:
• identify a notable event from data reflecting the operation of computing devices in an information technology (IT) environment, wherein the notable event is identified based on a notable event definition, and wherein the notable event is associated with a notable event type;
• and
• a second one or more electronic devices to implement a monitoring system, the monitoring system including instructions that upon execution cause the monitoring system to:
• receive an indication of the notable event;
• generate an invokable action message, wherein the invokable action message includes information based on an invokable action message definition associated with the notable event type, wherein the invokable action message definition identifies at least a first recipient and a second recipient of the invokable action message;
• send the invokable action message to a first computing device associated with the first recipient, wherein the invokable action message causes the first computing device to display a user interface including an interface element corresponding to an invokable action associated with the invokable action message;
• determine that a period of time has elapsed without a response from the first computing device associated with the first recipient;
• responsive to determining that the period of time has elapsed, send the invokable action message to a second computing device associated with the second recipient
• receive, from the computing device, an action invocation message associated with the invokable action;
• and
• execute the invokable action.