Alerting & Notifications
Alerts on host metrics and security events, delivered to where your team works. Metric thresholds, scanner findings, file integrity, access events and log rule matches.
Alert Rules
Host metric thresholds: CPU, memory, swap and disk usage
Anomaly and forecast rules on host metrics (e.g. disk-full forecast)
Duration windows: fire only when the average over the window breaches
Vulnerability, malware and hardening scanner findings
File integrity: sshd_config, PAM, authorized_keys, systemd units
System drift: users, packages, kernel modules, SUID binaries
Access events: failed SSH logins, root logins, unauthorized sudo, brute force
Log rule matches (regex over collected logs) by severity
Listening port changes and security score drops
Global or per-agent rules
Auto-resolve for metric alerts when the value recovers
Error and critical alerts auto-open de-duplicated incidents
4 Notification Channels
Slack
Incoming webhook with formatted Block Kit messages
Microsoft Teams
Webhook with Adaptive Card messages
Telegram
Bot token + chat ID
Custom Webhooks
HTTPS POST/PUT with a JSON payload
Channel Features
- Channels configured once in Admin → Integrations and attached to rules
- Multiple channels per rule
- Webhooks are HTTPS-only, with private-network addresses blocked
- Alert activity feed with linked incidents