Alerts and Notifications

Alerts turn incidents into notifications. This page covers how alerting works in Dstl8 and how to create and edit alert rules.

How alerting works

The flow has four parts:

Incident → Alert rule → Detection → Notifications (one per channel)

• An alert rule defines which incidents you care about and where to send notifications. Incident is the only rule Kind currently supported.

• When an incident matches a rule, Dstl8 creates a single detection that records the rule firing.

• That detection is distributed as a notification to each channel attached to the rule.

• Detections are also a persistent record in the UI, so you can always see which rules fired and when.

Channels

A channel is a destination for notifications. Dstl8 supports three channel types:

• Email: a default email channel (Default Admin Alerts) is created automatically and sends to the org admin who signed up for the account. You can add more email channels for other addresses/users.

• Slack: requires a Slack integration at the org level.

• Teams: requires a Teams integration at the org level.

To add a channel, go to Channels, click Add Channel, give it a name, choose the channel type, and (for Slack or Teams) select the integration to use.

Integrations

Slack and Teams channels are backed by org-level integrations. Set these up under Integrations before creating a channel of that type. Email is already setup and needs no integration.

Creating an alert rule

From Alert Rules, click Create Alert Rule. There are two steps.

Step 1: Basic Info

• Name: a label for the rule.

• Kind: Incident. This is fixed and cannot be changed after creation.

• Enabled: whether the rule is active.

• Channels (optional): the channels that receive notifications when the rule fires.

• Workspaces (optional): scope the rule to specific workspaces.

Step 2: Detection

These conditions control which incidents match the rule:

• Statuses: scope the rule to incidents in selected lifecycle statuses.

• Environments (optional): scope to specific deployment environments.

• Impact: filter by incident severity.

• Resource Types: scope to specific resource kinds such as pod or service.

• Trigger Mode: when the rule fires relative to the incident lifecycle. Creation fires when an incident is first created. Status Change fires when an incident changes status.

• Min Age (seconds): minimum incident age before the rule triggers. Only applies when Trigger Mode is Status Change.

Click Create to save the rule.

Editing an alert rule

From Alert Rules, open a rule and edit it. On the Basic Info step you can update the name, channels, and workspaces. Kind cannot be changed.

Detections

Detections are the persistent log of rule activity. Each row shows when the detection was created, the timestamp of interest, the rule Kind and value (for example critical), the workspace and environment, and which rule fired.

Example: send default incident emails to a teammate

To have another team member receive email notifications for incidents:

1. Go to Channels and click Add Channel.

2. Set the channel type to Email and enter the teammate's address, for example [e-mail].

3. Go to Alert Rules and edit the Default incident rule.

4. Add the new channel under Channels and save.

The teammate now receives email for every incident that matches the rule.