---
title: "(Beta) Alerts"
slug: "alerts"
description: "Traceable Alerts help you monitor API security events, application activity, and configuration changes across your environments. Create custom security alerts, define alert conditions, and send notifications through email, Slack, Splunk, Syslog, Amazon S3, webhooks, and other supported integrations. Use Alerts to reduce notification noise, improve incident response, and stay informed about critical API security and operational events."
status: "new"
updated: 2026-07-21T11:23:40Z
published: 2026-07-21T11:23:40Z
canonical: "traceabledocs.document360.io/alerts"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://traceabledocs.document360.io/llms.txt
> Use this file to discover all available pages before exploring further.

# (Beta) Alerts

Staying informed about important security and application events is critical to maintain a strong security posture. Alerts in Traceable help you proactively monitor activity across your environments and ensure that the right teams are notified when malicious events are identified. With Alerts, you can define specific conditions to track, such as newly discovered vulnerabilities, policy violations, and changes in risk levels. When those conditions are met, Traceable generates notifications through your configured channels, helping you respond quickly and focus on the issues that require attention.

Alerts also give you control over how and when notifications are delivered. You can tailor alert conditions, choose notification destinations, and configure delivery frequency to reduce noise while ensuring that critical events do not go unnoticed. It also helps you streamline the types of alerts you wish to receive and the frequency at which you wish to receive them.

## What will you learn in this topic?

By the end of this topic, you will be able to learn:

- Understand how alerts help monitor security events, operational changes, and application activity across the platform.
- Create and configure channels to deliver alerts through *E**mail*, *Slack*, *W**ebhooks*, *Syslog*, *Splunk*, *Amazon* *S3*, and other supported destinations.
- Create alerts for different Traceable modules and event categories, as required.
- Configure alert conditions, environments, and notification frequency to reduce noise and focus on relevant events.
- The steps to manage existing alerts.

---

## Before you begin

Before you proceed to create an alert channel and an alert, make a note of the following:

- Make sure you have the *View* and *Edit* RBAC permissions under **Administration** → **Notifications** to create the channels and alerts. For more information, see [Team and roles - RBAC](https://docs.traceable.ai/docs/rbac).
- For Wiz-based alerts, make sure you have configured the Wiz integration under Integrations. For more information, see [Wiz Integration](/v1/docs/wiz-integration).

---

## Steps to configure alerts

Before creating alerts, you must create a channel to identify the channel to which you wish to send alert notifications. Complete the following steps:

### Step 1 — Create a channel

To create a new channel, navigate to **Settings** (![traceable_icon_settings](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_icon_settings.png)) → **Configuration** → **Alerts**. Click **+ Add New Channel** under the **Channels** tab.

In the **New Channel**, slide-out panel, complete the following steps:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceble_alerts_new channel creation(1).png)

Create a new channel for alerts

1. **Name** — A name associated with your channel that will receive the alert notifications, for example, *ast-scan_run_alert*.
2. **Alert Destination** — A channel is a group of media or people you want to notify when a type of event is triggered. You can send notifications to one or more of the following channels:
  - **Email Addresses** — Sends notifications directly to the specified email address(es), ensuring that users receive alerts in their inbox(es). You can send these alerts to one or more users by adding a comma-separated list of email addresses.
  - **Slack Webhook** — Delivers notifications to Slack channels, enabling real-time collaboration and immediate visibility of events within team workflows. For information, see [Sending messages using Incoming Webhooks](https://api.slack.com/messaging/webhooks).
  - **S3 Webhook** — Stores notification payloads in Amazon S3, allowing integration according to your requirements for further analysis or compliance. For more information, see [S3 Integration](https://docs.traceable.ai/docs/s3).

> [!NOTE]
> Note
> 
> When configuring an S3 Webhook, ensure that you configure the Audience in your S3 bucket. Contact Traceable's support at [support@traceable.ai](mailto:support@traceable.ai) to obtain the Audience value for configuration in AWS.
  - **Splunk Webhook** — Integrate with Splunk to forward notification data, which supports advanced log analysis and monitoring capabilities using its dashboard. For information, see [Splunk documentation](https://docs.splunk.com/Observability/admin/notif-services/webhook.html).
  - **Syslog Server** — Sends notifications to a Syslog server, enabling centralized logging and integration with traditional IT operational tools. For more information, see [Syslog documentation](/docs/syslog).
  - **HTTP Event Collector Webhook** — Once enabled, this sends a notification to the specified channel if any HTTP Event Collector events are triggered on Splunk. For more information, see [HTTP Event Collector (HEC) Integration](/docs/hec-integration).
  - **Custom Webhook** — Provides a customizable endpoint for delivering notifications, allowing integration with third-party systems or workflows according to your requirements.
3. Click **Save**.

### Step 2 — Create a new alert

Once you have created a channel that should be notified, you should set up alert notifications for different categories. To create alerts, navigate to **Settings** → **Alerts →** **+Add New Alert** and complete the following steps:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_settings_alerts.png)

Create a new alert

#### Step 1 — Configure

In the **New Alert** slide-out panel, complete the following steps:

1. Specify a **Name** for your alert, for example, *AST-alert-scans*.
2. Specify a **Category** for which you wish to create the alert, for example, *Scan Run*.
3. Specify the **Environments** for which you wish to create an alert, for example, *All Environments*.
4. Specify the **Event Type** you wish to create an alert for, for example, *Create* or *Update.*

> [!NOTE]
> Note
> 
> The event type depends on the category you select.
  1. **Create** — Triggers the alert when a new resource is created.
  2. **Update** — Triggers the alert when a new resource is updated.
  3. **Delete** — Triggers the alert when a new resource is deleted.
5. In the **Set Alert conditions** section, you can enable the **Advanced toggle** to add multiple condition groups. This enables you to compare different attributes using operators, according to your requirements. You can choose to send an alert when all or any of the conditions match using the **Match All** and **Match Any** attributes, as shown below:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_settings_alerts_advanced_configs.png)

Set Alert Conditions

**Condition Groups** — The outermost layer of the alert logic, where each group contains one or more conditions. When multiple condition groups are configured, they are evaluated together using a **Match All** or **Match Any** operator at the outer level.
  - **Conditions** — The inner layer, nested within a condition group. Each condition evaluates a single attribute against a specified value or field. Conditions within the same group are also connected using a **Match All** or **Match Any** operator.
    - **Match Any** — Triggers the alert when at least one condition or condition group is met.
    - **Match All** — Triggers the alert when all conditions or condition groups are met.
    - **Condition Groups** — The outer layer that contains one or more conditions, connected to other groups using **Match All** or **Match Any**.
      - **Condition** — The inner layer that evaluates a single attribute against a specified value or field.
      - **Operators** — The comparison logic used within a condition, such as equals (`=` ), not equals (`!=`), matches any value in a list (`In`), and excludes values in a list (`Not In`). You can select one of these according to your requirements.

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_settings_alerts_advanced_configs.png)

Set Alert Conditions

> [!NOTE]
> Note
> 
> The **Advanced** toggle is visible based on the category of alert you select above.
6. Click **Next**.

#### Step 2 — Destination

The **Destination** step allows you to specify the email addresses, channels, or both to notify for a particular alert. In the **Destination** step, complete the following steps:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_new-alert_destination-step.png)

Destination

- Specify the **Email Addresses** of the associated accounts or people that should be notified for this alert.
- Specify the **Channel** you wish to notify of this alert. You can choose the channel you created above in the [Create a channel](/v1/docs/alerts#create-a-channel) section, or any other channel that can take action on the alert.

You can set the frequency limit for notifications sent for an alert. You can enable the **Limit Notification** toggle to add the following details:

- **Receive up to** — The number of notifications to be sent for a particular alert, for example, *2.*
- **Notifications, in** — The time span during which the notification alert should be sent, for example, *20 minute(s)*. You can also choose the time span in *hour(s)*, *minute(s)* or *days* according to your requirements.

---

## Module-specific alert categories and attributes

You can create an alert for different modules in Traceable. The following table lists the different categories for each module within Traceable:

| Module category | Category attributes |
| --- | --- |
| [APIST Alert Use Cases](/v1/docs/apist-alerts) | - Authentication Hook - Plugin - Scan Run - Runner |
| [Protection Alert Use Cases](/v1/docs/protection-alerts) | - threat actor - API Protection - Custom Signature - Data Loss Prevention - Exclusions - Enumeration - Malicious Sources - Rate Limiting - Security Event – Rule Triggers - Threat Auto Blocking - Threat Scoring Configuration - Web Application Firewall |
| [Discovery Alert Use Cases](/v1/docs/discovery-alert-use-cases) | - API Endpoint - Issues - Backend - MCP Tools |

---

## Manage alerts

After you have created your alerts, under the **Alerts** tab, you can perform the following actions. The following table describes the actions available for managing alert notifications:

| Action | Description |
| --- | --- |
| **Enable/Disable** | Use the toggle to enable or disable the alert notification according to your requirements. |
| **View** | View the alert notification configuration and details using the **Ellipse** (![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_catalog_posture_events_ellipse_icon.png)) icon. |
| **Edit** | Modify the alert notification configuration using the **Ellipse** (![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_catalog_posture_events_ellipse_icon.png)) icon. |
| **Delete** | Permanently remove the alert notification using the **Ellipse** (![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_catalog_posture_events_ellipse_icon.png)) icon. |

---

## Wiz integration

You can use the **Wiz Integration** tab to configure the threat activity events that Traceable forwards to Wiz. This integration helps you correlate API threat activity detected by Traceable with cloud security findings in Wiz, enabling centralized investigation and risk analysis. Unlike standard notification channels, Wiz Integration allows you to define Wiz-specific attributes, such as **Environment**, **Threat Type**, **Severity Level**, and **Confidence Level**. Traceable sends only the events that match the configured criteria to Wiz.

To add a wiz integration alert, navigate to **Settings → Configuration → Alerts**. Select the **Wiz Integration** tab and click **+ Add New Wiz Integration**. In the **New Wiz Integration** slide-out panel, complete the following steps:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_alerts_wiz.png)

Wiz Integration

1. Specify a unique **Name** for the Wiz alert configuration, for example, *wiz-based-alerts.*
2. Specify the **Category** of threat activity events to forward to Wiz, for example, *Monitored Threat Activity*.
3. Specify the **Environment** from which Traceable sends events to Wiz, for example, *All environments*.
4. Specify one or more relevant **Threat Types** to send to Wiz.
5. Specify one or more **Severity Levels** for the events that Traceable forwards to Wiz, for example, *High*, *Critical*.
6. Specify one or more **Confidence Levels** for the events that Traceable forwards to Wiz, for example, *High*.
7. Click **Save**.

The audience value is often represented as the "Audience" or "Client ID" parameter in the identity provider's configuration settings. It is typically a unique identifier specific to the AWS service or resource that expects to receive the authentication token. By using the audience value, the AWS service or resource can validate the authenticity and intended recipient of the authentication token, providing an additional layer of security for the authentication process.

A suspicious or malicious user, IP address, or entity identified by Traceable based on anomalous behavior, security events, and threat activity observed across APIs and applications

A rule that controls API request volume within defined time windows to improve traffic efficiency, prevent abuse, reduce sudden traffic spikes, and maintain application stability by enforcing configurable request thresholds and actions.