# Real-time alerts

Slack, Teams and webhook notifications for high-severity events.

# Overview

# Real-time alerts

Don't watch dashboards — get paged. Sentilai posts to your channels the moment a qualifying governance event fires.

## Channels

- **Slack** — an incoming-webhook URL; alerts arrive as formatted messages.
- **Microsoft Teams** — an incoming-webhook URL; alerts arrive as cards.
- **Generic webhook** — a JSON payload for anything else (SIEM hooks, PagerDuty ingestion, custom automation).

## What fires

An alert is sent when an event's severity reaches the channel's **floor** (default: high only), or whenever a request is **blocked** — a block is always alert-worthy. Severity comes from the risk detectors and the AI classifier.

## Setting up

On the **Policy** page, under **Real-time alerts**: pick the channel type, name it, paste the webhook URL, choose the severity floor, and use **Send test** to verify delivery before saving. The destination URL is stored encrypted and never displayed again — treat it like a credential, because anyone holding it can post into your channel.

## Behavior

Delivery is fire-and-forget with a short timeout: alerting can never slow down or fail a developer's AI request. Each qualifying event posts once per matching channel.

# Set up an alert channel

Nobody watches a dashboard. Alerts put the findings that matter into the place your team
already looks.

## Adding a channel

**Policy → Real-time alerts → add a channel:**

- **Kind** — Slack, Microsoft Teams, or a generic JSON webhook.
- **Name** — how it appears in the list. Name it after the destination, not the event:
  "#security-alerts" tells you more later than "high severity".
- **Fires on** — the minimum severity: **High only**, **Medium and up**, or **Low and up
  (all)**.
- **Webhook URL** — must be `https`.

## Test it immediately

**Send test** posts a message to the channel. It reports "✓ Sent", or tells you the
destination did not accept it. Do this before you rely on it — a mistyped webhook URL
fails silently forever otherwise.

## The URL is write-only

Once saved, the webhook URL is never shown again. A Slack or Teams webhook URL is a
credential — anyone holding it can post into your channel — so it is stored the same way a
provider key is. To change it, remove the channel and add it again.

## Enable, disable, remove

Each channel can be disabled without losing its configuration — useful during a noisy
migration — and removed permanently.

## Choosing a severity

Start at **High only**. A security channel that fires constantly is a channel people mute,
and a muted channel is worse than no channel because you believe you are covered.

Widen to Medium once you know what High actually produces in your organization.

<!-- shot:policy-alerts -->
![Alert channels — Slack, Teams or a plain webhook, with a test send before you save.](https://docs.sentilai.com/uploads/images/gallery/2026-08/xEwpolicy-alerts.png)
*Alert channels — Slack, Teams or a plain webhook, with a test send before you save.*

# What alerts are for

## The delivery guarantee

Alerts are **fire-and-forget**. Delivery is attempted alongside the request, never in front
of it: a Slack outage cannot slow down or fail your developers' AI traffic. The trade-off
is that an alert can be lost if the destination is unreachable, so alerts are a
notification mechanism and not an audit trail.

**The audit trail is Activity, Compliance and your SIEM.** If you need guaranteed
delivery of every event, use [Stream events to your SIEM](/books/compliance-and-siem/page/stream-events-to-your-siem) — that path is built for
completeness. Alerts are built for attention.

## What to route where

- **Slack or Teams** for the things a human should look at today: high-severity classifier
  verdicts, secrets blocked, a lethal-trifecta block.
- **A generic webhook** when you want to drive something automatic — open a ticket, page
  someone, tag a device in your own tooling.

## Multiple channels

You can have several, each with its own severity threshold. A common arrangement is a
noisy engineering channel at "Medium and up" and a quiet security channel at "High only".

## What not to do

Do not use alerts as your compliance evidence. When an auditor asks what happened in March,
the answer comes from the evidence pack on **Compliance**, not from a Slack channel with a
90-day history and no guarantee of completeness.