Configuring Alert Rules

Score Increase Alerts

The score_increase trigger type is the most complex alert rule. It is evaluated by the hourly alert evaluation job rather than firing synchronously:

  • The job checks recent exposure snapshots for each space key listed in the rule’s scope
  • For each page in those spaces, it computes the delta between the most recent score and the previous score
  • If any page’s delta equals or exceeds the rule’s threshold value (default: 20 points), the rule fires
  • A debounce window (default: 60 minutes) prevents the same rule from firing repeatedly within the cooldown period

Reading a score increase alert:

Exposure score increased by 28 points across 2 page(s). Threshold: 20.

Affected pages:
- Content 12345678: score 31 → 59 (+28)
- Content 87654321: score 45 → 67 (+22)

Important constraint: The score_increase trigger requires explicit space keys, it will not fire if allSpaces: true is set. This prevents the hourly job from evaluating potentially thousands of spaces. Always specify the space keys you want monitored for score drift.


Inline Alerts (Synchronous)

The following alert trigger types fire immediately when the event occurs, rather than waiting for the hourly job:

TriggerWhen it fires
new_findingAny new finding is created (manual, CSV, or scanner)
critical_findingA new critical-severity finding is created
high_findingA new high-severity finding is created
sla_breachA case’s SLA deadline passes (detected by daily job, near-synchronous)
scan_completeA content scan transitions to idle
new_caseA new case is created
classification_changeA space or page classification label is set or changed

These inline alerts bypass the hourly job entirely. The alert record is created within seconds of the triggering event.


Configuring Alert Rules (Admin)

Admin users see an Alert Rules panel at the top of the Alerts tab. The rules panel shows all configured rules with their status, trigger type, cooldown, and scope.

Alert Rules panel, configured rule list showing trigger type, cooldown, scope, enabled toggle, and Add Rule button

Creating a new rule:

  1. Click Add Rule
  2. Fill in the rule form:
    • Rule Name (required): A descriptive label, e.g., “Critical Exposure in Finance Space”
    • Alert Severity: The severity label attached to triggered alerts (Critical / High / Medium / Low)
    • Trigger Type: Select from the 10 supported trigger types (each shows a description below the option)
    • Score Delta Threshold: Only shown for score_increase; the minimum point increase to trigger
    • Cooldown (minutes): Minimum time between repeated fires for the same rule (default: 60)
    • Space Scope: For space-aware triggers, toggle between “All spaces” and “Specific spaces only”. Enter comma-separated space keys (e.g., FINANCE, LEGAL, HR) for specific scope. Required for score_increase.
    • Rule enabled: Toggle to activate/deactivate without deleting
  3. Click Create Rule

Editing a rule: Click Edit on any existing rule. The form pre-fills with current values.

Toggling a rule: Click the toggle switch on any rule to enable or disable it without deleting or editing.

Deleting a rule: Click Delete on any rule card. No confirmation dialog, deletion is immediate.


Delivery Log (Admin)

Admins can access the Delivery Log via the “Delivery Log” button in the toolbar. This shows all delivery-attempt entities, the records of in-app notification delivery.

Delivery attempt columns:

FieldMeaning
Status lozengeUNREAD / READ / DISMISSED (notification statuses) or failed/dead-letter (delivery failures)
Destination type“in-app”
TimestampWhen the delivery was attempted
Event typeThe event that triggered this delivery
ErrorError message if delivery failed

Retry: Failed or dead-letter delivery attempts have a Retry button. Clicking it resets the delivery status to UNREAD, making the notification visible again in the recipient’s bell panel.

When to use the delivery log: If a user reports they are not receiving expected notifications, check the delivery log to see if delivery attempts are being created and whether any are failing. Failures typically indicate a configuration issue (e.g., missing destination in the channel config).