Alerting get started

Create a channel, test it, add your first rule. Ten minutes to a working alert, with the three rules worth having on any site.

This page takes you from nothing to one working alert.

Prerequisites

Before you start, make sure you have:

A plan that includes alerting.
Website role Manager or Admin.
A destination ready. For Slack that is an incoming webhook URL. For email it is addresses that belong to workspace members.

1. Create a channel

Alerts > Configuration > Add channel. Name it after who reads it rather than what it is, so Security team Slack is clearer than Slack 1.

Pick the type and paste the destination. The URL format is checked as you type.

2. Test it

Select Test on the new channel. A sample alert goes out immediately.

Do not skip this. A wrong webhook URL and a revoked webhook both look identical in the configuration, and the difference only shows up when a real alert fails to arrive.

3. Add your first rule

Add rule, then:

Name: What the notification should be called.
Event: Start with Content Security Policy > New violation type.
Channels: The one you just made.
Cooldown: Leave it at 15 minutes.

Save. The rule starts watching on the next sweep, within a minute.

4. Confirm it works

You will not get an alert immediately, and that is correct. The rule fires the first time a violation type appears that has not been seen before, and it never replays history.

To confirm the plumbing rather than wait, rely on the test you sent in step 2. To confirm the rule, check Delivery history after a day.

The rules worth having

Once the first one works, add these two:

PCI compliance > Unjustified script on payment pages, if you handle card data. This is the one tied to a requirement, and it should reach a person, not just a channel.
Script hashes > New script origin. A new party started executing code on your pages.

Hold off on spike rules until you know the site's normal hourly volume. For tuning them, refer to Rules.

Alert rules do not cover running out of quota, and hitting your limit stops ingestion across the whole workspace. Set recipients under Settings > Usage. For more information, refer to Usage alerts.

Next steps

You now have one tested channel and one rule notifying it. Add the remaining rules you need, then check delivery history the first time an alert is expected.

Get started