Alerts & Notification Channels

Configure alerts around the activity that matters

When alerts are enabled for your workspace, teams configure rules in the Analyst Portal through three steps: choose a trigger, set its conditions, and select destinations. Rules can watch investigation reports, repeated signals, attestation volume, decision activity, or accounts sharing observed device and network references. Your team decides which changes warrant attention.

For activity rules, choose a rolling time window and a threshold, then measure evaluations, distinct accounts, or observed devices. Evaluate the condition across the workspace or within supported groups, such as an account or IP address. Signal rules can require any or all selected findings on an evaluation and set a minimum confidence. Decision-percentage rules include a minimum sample size, so a small number of evaluations does not create a misleading spike.

Report rules work differently: choose a severity or minimum severity, then notify on every matching publication or only when a new investigation episode appears or its severity escalates. The latter keeps an unchanged finding from repeatedly interrupting the team. Report notifications follow the reporting schedule; activity rules use their configured rolling windows.

Send findings to the team responsible for the response

Connect a Slack workspace and choose a channel, or configure a custom webhook to deliver JSON to an HTTPS endpoint. Destinations are reusable, and a rule can send to more than one. That lets an urgent investigation reach a fraud operations channel while a technical integrity pattern goes to the security team or an internal incident workflow.

For report alerts, the notification includes severity and an authenticated portal link, keeping the investigation and its attachments behind workspace access controls. Webhook receivers can verify request signatures and use event identifiers to deduplicate notifications. Operators and administrators manage integrations; authorized analysts can configure rules within their workspace permissions.

Set a minimum interval between activity notifications and choose whether to notify when the threshold is crossed again or send reminders while the condition persists. Rules and destinations can be paused separately. These controls let teams tune the volume of notifications as they learn which patterns deserve an immediate response.

Test destinations and review delivery activity

Test a destination before relying on it, then use the portal’s integration status and rule activity to check delivery. The history identifies the rule and destination, notification time, delivery status, attempts, and available receiver response details. Teams can distinguish a queued notification from an acknowledged delivery or a failure that needs attention.

This makes routing problems visible alongside the rules that depend on a destination. A paused integration or lost Slack access needs a different fix from an alert condition that has not been met. Delivery acknowledgements confirm the receiver accepted the notification; they do not establish that someone reviewed it. Your team retains ownership of investigation and response.