Configure alert rules to get notified when events happen in ops0 — deployment outcomes, policy violations, security findings, approval requests, drift detection, and more. Route each alert type to Slack channels or email with fully customisable message templates.
ops0 has nine alert categories, each covering a distinct type of event:
| Category | Events | Severities |
|---|---|---|
| Incidents | IaC incidents created or escalated | P1, P2, P3 |
| Vulnerabilities | Security findings from Trivy scans | Critical, High, Medium, Low |
| Cost Reports | Cost estimates generated for deployments | Info, Warning |
| Recommendations | Optimization and best-practice suggestions from IaC analysis | Info, Warning |
| Validations | Results from terraform validate and TFLint runs | Error, Warning |
| Deployments | Deployment started, completed, failed, or cancelled | Info, Warning, Error |
| Drift | Infrastructure drift detected between discovery sessions | Info, Warning, Error |
| Policy Violations | Deployments declined by a blocking policy | Error |
| Approvals Needed | Deployments paused and awaiting manual approval | Info |
Go to Alerts in the sidebar.
Click + New Alert. A gallery of category presets appears.
Choose the closest preset to what you need. Presets pre-fill the category, severity filter, and a suggested template. You can also start from scratch.
| Field | Description |
|---|---|
| Name | Rule name |
| Category | Event category (see table above) |
| Minimum Severity | Only fire for events at this severity or above |
| Notify Mode | Every time (fire on every matching event) or On change (fire only when status changes) |
| Destinations | Slack channels and/or email recipients |
| Slack Template | Message template for Slack notifications |
| Email Template | Message template for email notifications |
Click Save. The rule activates immediately.
| Mode | Behaviour |
|---|---|
| Every time | Fires a notification for every matching event, regardless of whether it is a repeat |
| On change | Fires only when the status changes — for example, from no incident to incident open, or from open to resolved. Prevents alert fatigue for persistent conditions. |
Select one or more Slack channels from your connected Slack integration. The channel list is populated from Settings → Integrations → Alert Channels.
Each Slack alert uses the Slack template assigned to the rule. If no template is assigned, a default plain-text message is sent.
Enter one or more email addresses. Multiple addresses are comma-separated. Each email alert uses the email template assigned to the rule.
Templates control the exact content of alert messages. They support variable placeholders that ops0 fills in at send time.
| Type | Format |
|---|---|
| Slack | Block Kit JSON or plain text |
| HTML with optional plain-text fallback |
On the Alerts page, click the Templates tab, then + New Template.
Choose a Slack or Email preset from the gallery, or start from a blank template.
Use the template editor with live preview. The preview panel renders the template with sample variable values so you can see exactly what recipients will receive.
Click any variable chip below the editor to insert it at the cursor. Variable chips are grouped by category.
The preview panel renders the template with sample variable values. For email templates, the preview shows the full branded email shell ops0 wraps your HTML content in — so what you see is close to what recipients receive.
Click Save.
All alert types share these base variables:
| Variable | Value |
|---|---|
{{category}} | Alert category (e.g. deployment) |
{{severity}} | Severity level |
{{title}} | Alert title |
{{message}} | Human-readable event description |
{{timestamp}} | ISO 8601 timestamp |
{{organizationId}} | Your organisation ID |
{{projectId}} | IaC project ID |
{{projectName}} | IaC project name |
{{link}} | Direct link to the relevant ops0 page |
Category-specific variables:
| Category | Extra Variables |
|---|---|
| Vulnerabilities | {{vulnCount}} — total findings count |
| Cost Reports | {{cost}} — estimated monthly cost |
| Recommendations | {{recommendationCount}} — number of suggestions |
| Drift | {{driftCount}} — number of changed resources |
| Policy Violations | {{violationCount}}, {{policyName}} |
The template editor includes a live preview panel that renders the HTML email in an iframe. What you see in the preview is close to what recipients will see in Gmail, Outlook, and other clients.
Click Ask Kiwi on the Alerts page to describe an alert in plain English and have Kiwi generate the rule or template for you.
Examples:
Kiwi generates the rule configuration or template body. Review and save as normal.
When a rule uses On change notify mode, ops0 tracks the last known value for each event type per project. A notification only fires when the value actually changes — for example, when a deployment transitions from completed to failed, or when the policy violation count increases.
This prevents alert fatigue for persistent conditions. A deployment that keeps failing will not send a new notification on every retry — only when its status first changes to failed.
The deduplication key is based on the combination of: organization, project, and event category. Values are compared against the last recorded value for that key.
The Approvals Needed category has an additional field: Approval Events.
| Value | When it fires |
|---|---|
needed | Only when a deployment first enters the awaiting-approval state |
approved | Only when an approver approves the deployment |
both | Both events |
Use needed to notify approvers that action is required. Use approved to notify the deployer that their deployment has been approved and will proceed.
The Alerts table shows all configured rules:
| Column | Description |
|---|---|
| Name | Rule name |
| Min Severity | Minimum severity that triggers this rule |
| Destinations | Slack channels and email recipients |
| Enabled | Toggle switch — disable without deleting |
Available actions per rule: Edit, Delete, Test.
Click Test on any rule to fire a sample notification immediately to all configured destinations. Use this to verify your Slack webhook is working and the template renders correctly before relying on it for live events.
The Alert Log shows the last 100 alert dispatches across all rules. Navigate to Alerts → Log to see:
| Column | Description |
|---|---|
| Timestamp | When the alert fired |
| Category | Alert category |
| Severity | Severity level |
| Title | Alert title |
| Status | sent, failed, or skipped (skipped when deduplication suppressed the alert) |
| Destinations hit | How many Slack channels / email addresses received the notification |
| Error | Error message if delivery failed |
Use the Alert Log to verify that alerts are firing and delivering correctly, and to debug misconfigured channels or templates.
The Templates table shows all saved templates:
| Column | Description |
|---|---|
| Name | Template name |
| Kind | Slack or Email |
| Updated | When last modified |
Available actions: Edit, Delete.
Templates are reusable across multiple alert rules. Deleting a template does not delete rules that reference it — those rules fall back to the default message format.
