---
title: "Discovery Alert Use Cases"
slug: "discovery-alert-use-cases"
description: "Here's a concise, SEO-friendly version with relevant API security keywords:  > Learn how to configure Discovery alerts to monitor API endpoints, domains, backends, third-party APIs, MCP tools, security issues, and API risk scores. Use advanced alert conditions to detect inventory changes, risk escalations, sensitive data exposure, and issue status transitions while reducing alert noise through targeted notifications. "
tags: ["API Exposure", "Discovery Alerts", "Risk Score"]
updated: 2026-07-21T06:34:47Z
published: 2026-07-21T06:34:47Z
canonical: "traceabledocs.document360.io/discovery-alert-use-cases"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://traceabledocs.document360.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Discovery Alert Use Cases

Traceable's advanced alert conditions enable you to create precise Discovery alerts by evaluating resource attributes and detecting meaningful changes over time. Instead of triggering notifications for every event, you can define conditions based on attribute values, compare previous and updated values, or combine multiple criteria using logical operators. The following table describes the different available attributes, event type, and its description:

| Category attributes | Event Type | Description |
| --- | --- | --- |
| [API Endpoint](/v1/docs/api-endpoints) | - Create - Update | Provides visibility into new and modified API endpoints identified during discovery. |
| [Backend](/v1/docs/domains-services-backends#backends) | - Create | Provides visibility into backend services identified during discovery. |
| [Third Party API Endpoint](/v1/docs/third-party-api-endpoints) | - Create - Update | Provides visibility into API endpoints belonging to third-party integrations. |
| [MCP Tool](/v1/docs/traceable-mcp-server#available-tools-and-capabilities) | - Create | Provides visibility into discovered MCP tools and their configurations. |
| [Domain](/v1/docs/domains-services-backends#domains) | - Create - Update - Delete | Provides visibility into domains identified during discovery, including additions and removals. |
| [Third Party](/v1/docs/third-party) | - Create | Provides visibility into third-party services identified during discovery. |
| [Issue](/v1/docs/issues) | - Create - Update | Provides visibility into security issues identified across your API inventory. |

---

## Advanced alert configuration sample scenarios

The following sample scenarios discuss how to configure condition groups and conditions for discovery alerts when you select the **Event Type** as *Update*:

### Scenario 1 — Notify when an API's risk score increases significantly

You wish to be notified when an API's risk score increases from low to high risk so you can investigate newly introduced security risks. To configure this, create a condition group with **Match All**, and add the following conditions:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable-discovery_alerts(1).png)

Discovery Use-case Alerts

| Attribute | Operator | Value |
| --- | --- | --- |
| Previous Risk Score | < | *2* |
| Updated Risk Score | > | *7* |

This configuration ensures that Traceable evaluates whether an API's risk score has increased and generates an alert only when the score exceeds the defined threshold. As a result, you receive notifications for meaningful risk escalations instead of every score update.

### Scenario 2 — Notify when sensitive APIs meet different exposure conditions

You wish to be notified when an external API handles regulated data, or when an internal API begins exposing highly sensitive credentials. To configure this, create two condition groups with **Match Any**, and add the following conditions:

#### Condition Group 1 (Match All)

| Attribute | Operator | Value |
| --- | --- | --- |
| External | = | *True* |
| Data Type | In | *PII, PCI, PHI* |

#### Condition Group 2 (Match All)

| Attribute | Operator | Value |
| --- | --- | --- |
| External | = | *False* |
| Data Type | In | *Secrets, Credentials* |

This configuration evaluates two independent security conditions within a single alert. Traceable generates an alert notification when either an externally exposed API processes regulated data or an internal API exposes highly sensitive credentials, eliminating the need to create and maintain separate alerts for each scenario.

### Scenario 3 — Notify on issue status transitions

You wish to be notified when an issue moves from an active state to a resolved or accepted state, so you can track remediation progress without manually monitoring every status change. To configure this, create a condition group with **Match All**, and add the following conditions:

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable_discovery_alert_scenario_3.png)

Discovery Alert Use-Case

| Attribute | Operator | Value |
| --- | --- | --- |
| Previous Status | In | *Accepted Risk, Under Review* |
| Updated Status | In | *Open, Reopened* |

This configuration evaluates both the current and updated issue status to detect specific status transitions. By combining the conditions using the Match All operator, Traceable generates a notification only when an issue moves from one of the specified current states to one of the defined target states, reducing notifications for unrelated status changes.

### Scenario 4 — Notify based on issue severity and traffic source

You wish to prioritize issues found in live traffic over issues found through other sources by applying different severity thresholds depending on where the issue was detected. To configure this, create two condition groups with **Match All** and add the following conditions, and then combine them using **Match Any** at the top level.

![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable-Discovery_use-case_scenario2(1).png)

Discovery Alert Use- Case

#### Condition Group 1 (Match All)

| Attribute | Operator | Value |
| --- | --- | --- |
| Updated Severity | In | *Medium, Critical* |
| Updated Source | In | *AST* |

#### Condition Group 2 (Match All)

| Attribute | Operator | Value |
| --- | --- | --- |
| Updated Severity | In | *Critical, High* |
| Updated Source | In | *Live Traffic* |

This configuration evaluates two severity-based conditions for issues detected through *Live Traffic*. Traceable generates a notification when an issue is detected in live traffic with *Critical*, *Medium,* or *Low* severity. By combining the condition groups with the **Match Any** operator, a single alert can monitor multiple severity thresholds while maintaining a common source condition, reducing the need for separate alert configurations.

> [!NOTE]
> Note
> 
> This scenario applies similarly to other issue categories, such as third-party, backend, domain, and MCP tool service issues, since these categories share the same severity and source attributes.