Alerts and notifications

Alert rules decide which events reach email, Teams or Slack. A rule's severity is a threshold: it decides whether an event is sent. The alert itself carries the event's own severity — a critical event sent through a rule set to Medium is labelled, coloured and recorded as critical, and the alert.created webhook says critical.

Repeats

Each event is sent once. Alerts are checked every 30 minutes looking back 25 hours, and anything already sent in the last 26 hours is not sent again. Some one-off events (an agent rolling back an update) are sent once ever, because their state stays visible on the agent afterwards.

Running an evaluation by hand (POST /api/v1/alerts/evaluate) records what it sends, so it doesn't repeat alerts the next run already sent.

On-premises agent alerts (agent_update)

For agents that check for updates (3.5.0 and later):

• rolled back an update — high, once per agent per failed version;
• could not undo a failed update — critical, once;
• reporting but no update check for over a day — medium, daily;
• no report at all for over a day — high, daily until it reports again.

Rollbacks older than 7 days are not raised.

What is never raised from missing data

"MFA Not Registered" fires only when a user's MFA status was actually recorded as not registered — an unknown status doesn't raise it. Offboarded (deleted) clients raise no alerts.