Various examples are disclosed for hybrid alert and action solution in Internet-of-Things (IoT) networks. A multi-edge alert definition specifies a plurality of IoT devices that communicate through edge devices. The multi-edge alert definition is decomposed decompose into individual edge alert sub-definitions. Each of the individual edge alert sub-definitions is evaluated using data from individual ones of the edge devices. An alert is triggered based on one of the individual edge alert sub-definitions being met.