Alerts and usage warnings
Hear about findings, tripwire hits, silent sources, and incidents by email, Slack, Discord, Teams, or any URL, and about your week every Monday.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
When alerts are sent
| What happened | When you hear |
|---|---|
| A new critical or high finding from a source rule | Straight away, once per finding; repeats update it without alerting again |
| A source goes silent | Straight away, once until events resume |
| A new critical or high finding from a site check | Straight away, at most once an hour for each domain |
| A new critical or high finding from a log drain or the SDK, including a new outbound host | Straight away, at most once an hour for each drain or project |
| A tripwire is hit | Within seconds, then quiet for 15 minutes for that tripwire |
| A critical or high incident affects your stack | Straight away, at most once in 24 hours for each incident |
| A revoke is scheduled, cancelled, done, or fails | Straight away |
| A log drain reaches the month’s log allowance | Once that month |
| 80 percent of the month’s fair use source events are used | Once that month. See limits |
| A free trial ends in about two days | Once, with the date and first payment |
Channels
| Channel | Plans | Setup |
|---|---|---|
| All | Owners and admins, plus extra addresses on the alerts page | |
| Slack | Starter, Pro, Business | Paste an incoming webhook URL (https://hooks.slack.com/services/...) |
| Discord | Starter, Pro, Business | Channel settings, Integrations, Webhooks; paste the URL (https://discord.com/api/webhooks/...). Mentions are off |
| Teams or any HTTPS URL | Starter, Pro, Business | Teams, Mattermost, or your own handler; gets the JSON below |
{
"text": "ShellOrbit: critical finding \"CloudTrail logging stopped\" from the source \"AWS production\". ...",
"content": "...the same text...",
"message": "...the same text...",
"url": "https://app.shellorbit.com/..."
}Alerts never contain source event bodies or keys. A channel URL is a credential: it is shown once, then masked. Private addresses are refused and redirects are not followed.
Test your alerts
Save your settings, then press Send test alert or call POST /v1/alerts/test. Each channel reports sent, or why not.
Weekly digest
Every Monday around 08:00 UTC, to the same addresses, covering Monday to Sunday:
- New findings by severity and by source, and how many were resolved.
- Sources that went silent, and incidents affecting you.
- Tripwire hits, and this month’s use of source events.
Quiet weeks send nothing. On by default on every plan; turn it off on the alerts page.