Alerts Admin Rule engine configuration · admin only

← back to Alert Center
Admin access required.
This page configures alert rules, notification channels, maintenance windows, and global defaults. It is available to administrators by default; your administrator can grant access to other groups via Settings → Groups.

Rules

Lookup by asset
See which rules will fire for a specific asset

Rules that would affect

Loading matches…

No enabled rules currently match this asset.

Rule Type Severity Scope Match reason

Loading rules…

No rules found. Click + New Rule above to create your first rule.

# Rule Type Category Severity Customer Affected Last fired Notify On Actions

Alerts Admin · Rules
← back to Rules
Name *
Rule type *
Severity *
Category *
Customer (empty = global)
Target type
Attribute filters (AND across rows)
Trigger config
Trigger state
Which account (provider)
Attribute key
Operator
Value
Data type
Event ID
Source
Severity min
Keyword (optional)
Hostname regex (optional)
IP allowlist (comma-separated, optional)
Trigger *
Allowed countries (ISO codes, comma-separated) *
Failures ≥ *
Within minutes *
Evaluated on each M365 sync for collected sign-in events. Events without location data are skipped by location rules; accounts not yet approved into Octotor are stored but not evaluated.
Check type *
Which jobs should this rule watch?
A JSON filter matching the jobs this rule applies to. Example: {"scheduled_task_id": 1234} watches only job runs from scheduled task #1234. Leave blank to match all jobs of the chosen check type.
When does it count as a problem?
A JSON rule describing the failing condition for the check type above. Example: {"match":{"exit_code":0}} fires when the job's exit code is 0.
Advanced — override config as raw JSON
Notify channels
Run task on fire (optional — admin only, Pro)
When this rule fires, the selected task runs (throttled by the task's cooldown & hourly cap). Manage alert-triggered tasks in the Scheduler (Trigger = "On alert").
No alert-triggered tasks yet — create one in the Scheduler (Trigger = "On alert") to enable auto-remediation.
When you save, the backend evaluates this rule against currently-matching assets and fires alerts for any breach (threshold rules only). By default those synth-fired alerts skip notification channels — check the box above to also send emails / Slack / webhooks for them.
Advanced — on_fire.actions JSON (leave empty for default: alert_center)
Template variables (available in title_template, detail_template, and webhook body_template): {{asset_name}}, {{asset_ip}}, {{customer_name}}, {{rule_name}}, {{severity}}, {{category}}, {{value}}, {{threshold}}, {{created_at}}, {{phase}}, {{alert_id}}, {{alert_title}}, {{alert_detail}}, {{alert_severity}}. Unknown variables render as empty string.
Schedule
Priority (1-10000)
Dedupe window (min)
Cooldown (min)
Affected assets
Calculating…
No assets match this rule yet.

Delete rule?

Delete rule ? Any alerts previously fired by this rule keep their audit trail; future firings stop. Per-asset overrides on this rule cascade-delete.

⚠ This rule runs a scheduled task when it fires (auto-remediation). Deleting the rule stops that automation — the task itself is not deleted and simply stops being triggered.

Notification Channels

Email / Telegram / Webhook destinations. Secrets (SMTP password, bot token) are encrypted at rest with AES-GCM and never returned on read — use the Customers button to assign a channel to specific customers (empty = global).

Loading channels…

No channels yet. Click + New Channel to create one.

# Name Type Scope State Actions

Fields marked * are required.

Config

Delete channel?

Delete channel ? Any rules referencing this channel by name will silently skip it at dispatch (a notify_failed audit row is logged when they fire).

Assign channel to customers

Channel . Leave all unchecked for a global channel (available to every customer).

Maintenance Windows

Scheduled alert suppression. During an active window, matching rule firings are logged to action_log as rule_suppressed_by_maintenance and no row is created in alerts. Scope is per-asset (list of IDs), per-customer, or global (both empty).

Loading windows…

No maintenance windows yet. Click + New Window to create one.

# Name Scope Start End Suppression State Actions

Fields marked * are required. Times use the browser's local timezone.

Scope

Leave both customer and asset IDs empty for a global window (suppresses matching alerts for every asset). Asset IDs filter alone already scopes by those assets; customer filter alone scopes by ownership.

Suppression

Common values: availability, security, health, policy, inventory, ingest, custom. Anything the rule's category matches will be suppressed during this window.

Delete maintenance window?

Delete window ? Any alerts that would have fired while this window was active have already been logged to action_log; deleting does not retroactively create them. If the window is currently active, deletion takes effect immediately.

Globals

Master enable / storm cap / retention / notifications kill-switch / AI-alerts local model / external-AI allow / daily token budget.

Global alert settings land in a future update. Until then, these settings remain on Settings → Alert Center.

Audit

Recent alert-category action_log entries (notify_sent / notify_failed / rule_suppressed / action_deferred) plus oct-alert-worker heartbeat + queue depth.

The audit view lands in a future update.