> For the complete documentation index, see [llms.txt](https://docs.controltheory.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.controltheory.com/controltheory-documentation/dstl8-docs/incidents/alerts-and-notifications.md). # Alerts and Notifications Alerts turn incidents into notifications. This page covers how alerting works in Dstl8 and how to create and edit alert rules. ### How alerting works The flow has four parts: `Incident` → `Alert rule` → `Detection` → `Notifications` (one per channel) * An **alert rule** defines which incidents you care about and where to send notifications. Incident is the only rule Kind currently supported. * When an incident matches a rule, Dstl8 creates a single **detection** that records the rule firing. * That detection is distributed as a **notification** to each channel attached to the rule. * Detections are also a persistent record in the UI, so you can always see which rules fired and when. ### Channels A channel is a destination for notifications. Dstl8 supports three channel types: * **Email**: a default email channel (**Default Admin Alerts**) is created automatically and sends to the org admin who signed up for the account. You can add more email channels for other addresses/users. * **Slack**: requires a Slack integration at the org level. * **Teams**: requires a Teams integration at the org level. To add a channel, go to **Channels**, click **Add Channel**, give it a name, choose the channel type, and (for Slack or Teams) select the integration to use. ### Integrations Slack and Teams channels are backed by org-level integrations. Set these up under **Integrations** before creating a channel of that type. Email is already setup and needs no integration. ### Creating an alert rule From **Alert Rules**, click **Create Alert Rule**. There are two steps. #### Step 1: Basic Info * **Name**: a label for the rule. * **Kind**: Incident. This is fixed and cannot be changed after creation. * **Enabled**: whether the rule is active. * **Channels** (optional): the channels that receive notifications when the rule fires. * **Workspaces** (optional): scope the rule to specific workspaces. #### Step 2: Detection These conditions control which incidents match the rule: * **Statuses**: scope the rule to incidents in selected lifecycle statuses. * **Environments** (optional): scope to specific deployment environments. * **Impact**: filter by incident severity. * **Resource Types**: scope to specific resource kinds such as pod or service. * **Trigger Mode**: when the rule fires relative to the incident lifecycle. `Creation` fires when an incident is first created. `Status Change` fires when an incident changes status. * **Min Age (seconds)**: minimum incident age before the rule triggers. Only applies when Trigger Mode is `Status Change`. Click **Create** to save the rule. ### Editing an alert rule From **Alert Rules**, open a rule and edit it. On the **Basic Info** step you can update the name, channels, and workspaces. Kind cannot be changed. ### Detections Detections are the persistent log of rule activity. Each row shows when the detection was created, the timestamp of interest, the rule Kind and value (for example `critical`), the workspace and environment, and which rule fired. ### Example: send default incident emails to a teammate To have another team member receive email notifications for incidents: 1. Go to **Channels** and click **Add Channel**. 2. Set the channel type to **Email** and enter the teammate's address, for example `new_user@example.com`. 3. Go to **Alert Rules** and edit the **Default incident rule**. 4. Add the new channel under **Channels** and save. The teammate now receives email for every incident that matches the rule. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.controltheory.com/controltheory-documentation/dstl8-docs/incidents/alerts-and-notifications.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.