Alert rules

Threshold alerts for DLP, blocks and injections.

Threshold alerts for DLP, blocks and injections.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

  1. Alert Rules → Add rule.
  2. Enter docs-dlp, docs-demo, dlp, pii.email, threshold 10, window 5, Cooldown 60.
  3. Enable and Save/Create.
  4. Simulate the rule and review matching events and trigger history.
  5. Connect an alert.rule.triggered webhook. Stop it with Edit → disable Enabled → Save.

Every control and its meaning

Control / parameterValues, units and effect
Название / tenant / kindName required; * means all tenants. blocked/injection/dlp/any selects event counts, unlike Router quota/cost kinds.
data_classEmpty matches all classes; a verdict ID such as pii.email narrows matching. This is not a regex field.
threshold / window_minutesThreshold ≥ 1 event over ≥ 1 minute. Example: 10 in 5 minutes; threshold is not a block percentage.
cooldown_minutes / enabledCooldown ≥ 0 minutes, e.g. 60; Enabled starts evaluation. Zero cooldown does not disable the rule.

Verify the result

Verify simulation, generation and delivery separately. Alert rules do not change mask/block for protected requests.

Errors, disabling and reverting changes

For missing triggers, check tenant/class/kind, window, threshold, enabled and cooldown. Restore prior values to revert.

Alert rule form for a test tenant · actual staging
Alert rule form for a test tenant · actual staging
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency.
  1. Tenant
  2. Event
  3. Threshold / window / cooldown
  4. Save
Alert rule form for a test tenant · actual staging
Alert rule form for a test tenant · actual staging
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency.
  1. Tenant
  2. Event
  3. Threshold / window / cooldown
  4. Save

Detailed security settings · Traffic analysis · FAQ · All application sections