# Triage alerts

> Clear the Alerts queue one vendor at a time: start with Needs action, open each decision, then Allow, Block or choose Not now. Keyboard shortcuts included.

Source: https://docs.scriptmonitoring.com/guides/triage-alerts/ · Plan: All plans · Updated 2026-10-13

To triage alerts, work through **Security > Alerts** one vendor at a time, starting with the critical and high decisions. Each decision takes one click: **Allow**, **Block** or **Not now**. What the score and each action mean is on the [Alerts reference](https://docs.scriptmonitoring.com/alerts/).

![The decision queue: n0rthwind.com Critical (payment skimmer found on the page), Google Tag Manager High, Klaviyo High, Intercom Medium and Cloudflare Low.](https://docs.scriptmonitoring.com/screenshots/alerts-queue-light.webp)

## How do I work through the queue?

1. Open **Security > Alerts**. The subtitle says how many open alerts there are in the top bar's date range and how many decisions they make.
2. Click **Needs action** to see critical and high decisions first. The other chips filter by band: **Critical**, **High**, **Medium**, **Low**.
3. Open a row (click it, or press Enter or O). The side sheet lists every open alert for the vendor: what happened, the script URL, why the rule fired, the rule name and score, the domain and when.
4. Decide:
   - **Allow** if the behavior is expected from this vendor.
   - **Block** if a flagged script should not run on your site.
   - **Not now** if you need to check with someone first.
5. Repeat until the page says **Queue clear**.

![The review sheet for n0rthwind.com: 10.0 Critical, why it scored 10.0 (Payment Skimmer, Script Monitoring Watchlist Match, Keylogger or Form Data Stealer), the load chain through Google Tag Manager, the PCI DSS 4.0.1 compliance gap and the pages it was seen on, with Not now, Allow and Block.](https://docs.scriptmonitoring.com/screenshots/alert-review-sheet-light.webp)

Keyboard: **J** and **K** move, **X** selects, **A** allows, **B** blocks, **I** is Not now. Select several rows to use **Allow all**, **Block all** or **Not now** in the bar at the bottom.

## What if I'm not sure yet?

Choose **Not now**. The decision moves to **Suppressed** at the bottom of the page and comes back in 7 days, or earlier if the vendor raises a new alert. **Bring back** returns it to the queue now.

![Suppressed decisions: vendors that were scored and cleared or snoozed with Not now. They are never hidden.](https://docs.scriptmonitoring.com/screenshots/alerts-suppressed-light.webp)

## What if the script is malicious?

Block it from the decision, then follow [Respond to a malicious script](https://docs.scriptmonitoring.com/guides/malicious-script/).

## Frequently asked questions

### I can't click Allow or Block. Why?

Only Super admins and Admins can allow, block and snooze. Viewers see the queue with a note saying so.

### A decision I put on Not now came back early. Why?

A new alert fired for that vendor. Not now lasts 7 days or until the vendor raises a new alert, whichever comes first.

### Can I undo a decision?

Yes. Allow and Block each show **Undo** in their toast. Undoing keeps the alerts resolved; the vendor needs review again, or its scripts load again.

## Related

- [Alerts (reference)](https://docs.scriptmonitoring.com/alerts/)
- [Respond to a malicious script](https://docs.scriptmonitoring.com/guides/malicious-script/)
- [Approve or block a vendor](https://docs.scriptmonitoring.com/guides/approve-or-block-a-vendor/)