How to Set Up Negative Coverage Alerts: Filters, Tiers, and Escalation

Step 1: Calibrate from your own coverage

Every filter in an alert rule needs a value you can defend. Pull four to eight weeks of tracked coverage and make six decisions:

Do not borrow another company's numbers. A trade-heavy corpus and a consumer corpus will not share the same definition of "high readership." For how volume without prioritization turns into noise, see When Media Monitoring Becomes Media Overwhelm.

Step 2: Choose the filters

Each filter catches a different failure mode. Alone, each one is noisy.

Sentiment. Negative coverage is closer to reputation risk than raw mentions, but sentiment needs context. See Choosing the Best Sentiment Analysis Tool for PR Success.

Publication list. Your Tier 1 list separates a board-read headline from a long-tail blog.

Title keywords. Delve has no executive filter. To catch an executive, use title keywords with their name. That finds headlines, not a name that appears only in the body.

Readership. High-readership negatives deserve faster attention than low-reach duplicates.

Theme. Themes slice coverage by the type of conversation, such as regulatory risk. You can use the themes Delve tags automatically or define your own. See custom themes.

Key messages. Each key message is a plain-language description of a claim you want coverage to carry. Delve checks whether it appears in the article. An alert can fire when a message is present. It cannot fire because a message is missing.

Combine at least two filters on every production rule, for example negative sentiment plus a Tier 1 publication list. Keep single-filter rules for a low-priority Watch channel, or leave them out.

Step 3: Set up three tiers

Map severity to action, not to anxiety. Delve gives you two alert types, and the split is when analysis exists (automations docs):

• Inbox alerts fire when coverage lands in the Inbox, before tracking and analysis. They can filter on publication lists, language, country, title keywords, and media type. They carry no sentiment, so use them for a fast heads-up.

• Post-tracking alerts fire after an article is tracked and analyzed. They add sentiment, readership, themes, key messages, topics, and more. Pair them with a track automation so the right articles are tracked and analyzed automatically.

Every filter value and response window above is an example. What the table prescribes is one owner, one window, and one destination per tier. One article can meet more than one tier. That is fine, because the higher tier is the one that opens an incident channel.

Add a tag automation that applies a Crisis label when an article meets your Escalate conditions. The docs' own example labels coverage that has high readership, a CEO name in the title, and negative sentiment. The label lets anyone filter the tracker to live incidents.

Delve alerts post to Slack, and the channel must exist before you configure the alert. If you need phone or SMS, route that Slack channel into your paging tool.

Step 4: Add theme and message alerts

Two extra lanes cover risks that outlet and name filters miss.

Theme lane. Negative sentiment plus a risk theme plus a readership floor catches category-level problems that never name your CEO, such as a regulatory story that mentions you in passing. Send it to its own channel with a named owner for that risk.

Message lane. Negative sentiment plus a key message tells you critical coverage is engaging with a claim you care about. Read it for whether the message is repeated, challenged, or turned against you. The alert does not say which.

Not every alert is a warning. The same key message filter without sentiment can tell you when a launch message pulls through in a priority outlet. Keep those in a separate channel so they never dilute your crisis tiers.

Step 5: Route, own, and add context

An alert without an owner is a notification, not a warning system.

Who receives each tier. Watch stays with analysts. Respond goes to the on-rotation communications lead. Escalate goes to the head of communications or a named crisis lead, plus whoever approves external statements. Publish the roster where the team already looks.

Who can silence it. Only the tier owner or their backup should mute or widen a rule mid-incident. Leave a "silence with reason" note for the postmortem.

After hours. Define coverage hours and an on-call path for Escalate only. If nobody owns nights and weekends, say so in the runbook.

Context. Once coverage is analyzed, the tracked item carries an article summary, article sentiment plus sentiment per brand mention and per topic, quotes, themes, and key-message pull-through, as documented under what happens after you track an article. Message pull-through only records which configured messages were found. It is not a tone score on that message. The owner can open the item and decide, instead of rebuilding context from a link.

Step 6: Test and tune

Do not wait for a live incident to learn your rules are wrong. Apply the same filters in the tracker over the last 30 days. The tracker has extra filters, such as subject, reach, and a date range, so test on the filters the alert shares with it: publication list, key message, topic, theme, sentiment, readership, and title keywords.

• Count how many Watch, Respond, and Escalate matches you would have had.

• Mark each as a true positive, a false positive, or a miss (a known issue that did not match).

• Look for patterns in false positives, such as syndicated reprints or category roundups.

• Tighten the publication list or add a filter, then re-run once.

• Confirm channels and owner lists are current.

• Review the rules after the first real Respond or Escalate alert.

If a quiet month would have produced dozens of Respond matches, the rule is too broad. If a known priority-outlet negative would have stayed silent, the publication list or title keywords are wrong.

What alerts cannot do

Two limits are worth stating plainly. Alerts do not fire on volume against a baseline. Compare daily volume and negative share in the tracker or dashboard. For automatic volume-anomaly alerting, other tools document it. Meltwater's real-time alerting page describes spike detection against historical baselines. Alerts also do not fire because something is missing, such as a key message that did not appear. Review message pull-through in your reports for that.

Common mistakes

Single-filter alerts. A keyword alone fires on everything.

No owner. A channel where everyone is responsible is a channel where nobody acts.

A readership floor set by guess. Calibrate it from your own tracked coverage.

Expecting alerts for absence. Alerts fire on what arrives, so a quiet day or a missing message produces nothing.

Never retiring rules. Old campaigns, former executives, and dead product names keep matching. Clean rules up each quarter.

Worked example (fictional)

Fictional company: Northline Analytics, a mid-market B2B analytics vendor. Not a Delve customer case study. Setup is illustrative.

Northline built a Tier 1 list from the outlets that covered its last three critical stories, set a readership floor from eight weeks of tracked coverage, and added the CEO's name as a title keyword. It created one key message about reliability.

On a Tuesday morning, a Tier 1 headline names the CEO. The Watch inbox alert fires to the analyst channel before analysis. The analyst opens it: a funding roundup that mentions Northline once. No action.

At 2:10 p.m., a priority business title publishes a critical reliability piece that does not name the CEO in the headline. After tracking and analysis, Respond fires with summary, quotes, and sentiment. The comms lead opens a brief for the spokesperson.

At 2:40 p.m., a higher-readership Tier 1 outlet runs a negative piece with the CEO in the headline. The Watch inbox alert fires first, on arrival. After tracking and analysis, Respond and Escalate fire too, and the Crisis label is applied. The reliability key message appears in the article, so the head of communications checks how it was used. The incident channel opens.

What to ask your vendor

Use these in a demo. Each one is testable.

1. Can we combine sentiment, a publication list, title keywords, and readership in one alert rule, and show it match a real past article?

2. Which filters are available before analysis and which after?

3. Can we filter on our own key messages and custom themes, not only predefined categories?

4. Who can mute or edit a live rule, and is the change logged?

5. How do after-hours Escalate alerts reach an on-call owner without flooding the Watch channel?

If the vendor cannot answer with a live configuration against your coverage, treat the slideware as incomplete.

Get started

If your team already monitors coverage but does not trust the alerts, start with the calibration step and ownership before you buy anything new. If you want alerts that sit on analyzed coverage, talk to Delve.