# Alerts

Source: https://docs.ops0.com/docs/alerts

Configure alert rules to get notified when events happen in ops0 — deployment outcomes, policy violations, security findings, approval requests, drift detection, and more. Route each alert type to Slack channels or email with fully customisable message templates.

---

## Alert Categories

ops0 has nine alert categories, each covering a distinct type of event:

| Category | Events | Severities |
|----------|--------|-----------|
| **Incidents** | IaC incidents created or escalated | P1, P2, P3 |
| **Vulnerabilities** | Security findings from Trivy scans | Critical, High, Medium, Low |
| **Cost Reports** | Cost estimates generated for deployments | Info, Warning |
| **Recommendations** | Optimization and best-practice suggestions from IaC analysis | Info, Warning |
| **Validations** | Results from `terraform validate` and TFLint runs | Error, Warning |
| **Deployments** | Deployment started, completed, failed, or cancelled | Info, Warning, Error |
| **Drift** | Infrastructure drift detected between discovery sessions | Info, Warning, Error |
| **Policy Violations** | Deployments declined by a blocking policy | Error |
| **Approvals Needed** | Deployments paused and awaiting manual approval | Info |

---

## Creating an Alert Rule

### Navigate to Alerts
Go to **Alerts** in the sidebar.

### Click New Alert
Click **+ New Alert**. A gallery of category presets appears.

### Select a preset
Choose the closest preset to what you need. Presets pre-fill the category, severity filter, and a suggested template. You can also start from scratch.

### Configure the rule

| Field | Description |
|-------|-------------|
| **Name** | Rule name |
| **Category** | Event category (see table above) |
| **Minimum Severity** | Only fire for events at this severity or above |
| **Notify Mode** | `Every time` (fire on every matching event) or `On change` (fire only when status changes) |
| **Destinations** | Slack channels and/or email recipients |
| **Slack Template** | Message template for Slack notifications |
| **Email Template** | Message template for email notifications |

### Save and enable
Click **Save**. The rule activates immediately.

---

## Notify Modes

| Mode | Behaviour |
|------|-----------|
| **Every time** | Fires a notification for every matching event, regardless of whether it is a repeat |
| **On change** | Fires only when the status changes — for example, from no incident to incident open, or from open to resolved. Prevents alert fatigue for persistent conditions. |

---

## Destinations

### Slack

Select one or more Slack channels from your connected Slack integration. The channel list is populated from **Settings → Integrations → Alert Channels**.

Each Slack alert uses the Slack template assigned to the rule. If no template is assigned, a default plain-text message is sent.

### Email

Enter one or more email addresses. Multiple addresses are comma-separated. Each email alert uses the email template assigned to the rule.

---

## Alert Templates

Templates control the exact content of alert messages. They support variable placeholders that ops0 fills in at send time.

### Template Types

| Type | Format |
|------|--------|
| **Slack** | Block Kit JSON or plain text |
| **Email** | HTML with optional plain-text fallback |

### Creating a Template

### Click New Template
On the Alerts page, click the **Templates** tab, then **+ New Template**.

### Select a preset
Choose a Slack or Email preset from the gallery, or start from a blank template.

### Write the template body
Use the template editor with live preview. The preview panel renders the template with sample variable values so you can see exactly what recipients will receive.

### Insert variables
Click any variable chip below the editor to insert it at the cursor. Variable chips are grouped by category.

### Preview
The preview panel renders the template with sample variable values. For email templates, the preview shows the full branded email shell ops0 wraps your HTML content in — so what you see is close to what recipients receive.

### Save
Click **Save**.

### Template Variables

All alert types share these base variables:

| Variable | Value |
|----------|-------|
| `{{category}}` | Alert category (e.g. `deployment`) |
| `{{severity}}` | Severity level |
| `{{title}}` | Alert title |
| `{{message}}` | Human-readable event description |
| `{{timestamp}}` | ISO 8601 timestamp |
| `{{organizationId}}` | Your organisation ID |
| `{{projectId}}` | IaC project ID |
| `{{projectName}}` | IaC project name |
| `{{link}}` | Direct link to the relevant ops0 page |

Category-specific variables:

| Category | Extra Variables |
|----------|----------------|
| **Vulnerabilities** | `{{vulnCount}}` — total findings count |
| **Cost Reports** | `{{cost}}` — estimated monthly cost |
| **Recommendations** | `{{recommendationCount}}` — number of suggestions |
| **Drift** | `{{driftCount}}` — number of changed resources |
| **Policy Violations** | `{{violationCount}}`, `{{policyName}}` |

### Email Template Preview

The template editor includes a live preview panel that renders the HTML email in an iframe. What you see in the preview is close to what recipients will see in Gmail, Outlook, and other clients.

---

## AI-Assisted Alert Creation

Click **Ask Kiwi** on the Alerts page to describe an alert in plain English and have Kiwi generate the rule or template for you.

**Examples:**
- *"Alert me on Slack when any P1 incident is opened"*
- *"Send an email every time a deployment fails in the production-api project"*
- *"Create a weekly cost summary template for the finance team"*

Kiwi generates the rule configuration or template body. Review and save as normal.

---

## Deduplication — How "On Change" Works

When a rule uses **On change** notify mode, ops0 tracks the last known value for each event type per project. A notification only fires when the value actually changes — for example, when a deployment transitions from `completed` to `failed`, or when the policy violation count increases.

This prevents alert fatigue for persistent conditions. A deployment that keeps failing will not send a new notification on every retry — only when its status first changes to `failed`.

The deduplication key is based on the combination of: organization, project, and event category. Values are compared against the last recorded value for that key.

---

## Deployment Approval Alerts

The **Approvals Needed** category has an additional field: **Approval Events**.

| Value | When it fires |
|-------|--------------|
| `needed` | Only when a deployment first enters the awaiting-approval state |
| `approved` | Only when an approver approves the deployment |
| `both` | Both events |

Use `needed` to notify approvers that action is required. Use `approved` to notify the deployer that their deployment has been approved and will proceed.

---

## Managing Alert Rules

The Alerts table shows all configured rules:

| Column | Description |
|--------|-------------|
| **Name** | Rule name |
| **Min Severity** | Minimum severity that triggers this rule |
| **Destinations** | Slack channels and email recipients |
| **Enabled** | Toggle switch — disable without deleting |

Available actions per rule: **Edit**, **Delete**, **Test**.

### Testing an Alert Rule

Click **Test** on any rule to fire a sample notification immediately to all configured destinations. Use this to verify your Slack webhook is working and the template renders correctly before relying on it for live events.

---

## Alert Log

The Alert Log shows the last 100 alert dispatches across all rules. Navigate to **Alerts → Log** to see:

| Column | Description |
|--------|-------------|
| **Timestamp** | When the alert fired |
| **Category** | Alert category |
| **Severity** | Severity level |
| **Title** | Alert title |
| **Status** | `sent`, `failed`, or `skipped` (skipped when deduplication suppressed the alert) |
| **Destinations hit** | How many Slack channels / email addresses received the notification |
| **Error** | Error message if delivery failed |

Use the Alert Log to verify that alerts are firing and delivering correctly, and to debug misconfigured channels or templates.

---

## Managing Templates

The Templates table shows all saved templates:

| Column | Description |
|--------|-------------|
| **Name** | Template name |
| **Kind** | Slack or Email |
| **Updated** | When last modified |

Available actions: **Edit**, **Delete**.

Templates are reusable across multiple alert rules. Deleting a template does not delete rules that reference it — those rules fall back to the default message format.

---

## Related

- [Alert Channels](https://docs.ops0.com/docs/settings/integrations/alerts): Connect Slack and webhook endpoints that alerts are routed to.

- [Incidents](https://docs.ops0.com/docs/iac/incidents): IaC deployment failure incidents.

- [Kiwi](https://docs.ops0.com/docs/kiwi): Use Kiwi to generate alert rules from natural language.