Documentation Index
Fetch the complete documentation index at: https://docs.getimmutable.dev/llms.txt
Use this file to discover all available pages before exploring further.
Overview
Alert rules monitor your event stream in real time and trigger notifications when specific conditions are met. Configure rules from Settings > Alerts in the dashboard.Rule Types
Immutable provides five built-in alert rule types:new_country
Triggers when an actor performs an action from a country they have never been seen in before. Requires geolocation enrichment.
Use case: Detect potential account compromise. A user who normally logs in from the US suddenly appears from an unrecognized country.
high_volume_destructive
Triggers when a high volume of destructive actions (e.g. *.deleted, *.removed) occurs within a short time window.
Use case: Detect mass deletion attacks or accidental bulk operations.
ingestion_spike
Triggers when event ingestion volume exceeds a configurable threshold relative to the workspace’s normal baseline.
Use case: Detect unusual API activity that may indicate a compromised API key or a misconfigured integration.
repeated_action
Triggers when the same action is performed repeatedly by the same actor within a short time window.
Use case: Detect brute-force login attempts, automated scraping, or retry loops.
off_hours
Triggers when actions occur outside of configured business hours.
Use case: Detect suspicious activity during nights, weekends, or holidays.
Alert Delivery
Alerts are delivered through two channels:Webhook
Alerts are POSTed to your configured endpoint as JSON with HMAC-SHA256 signature verification. Headers:Content-Type: application/jsonX-Immutable-Signature: sha256={hmac_hash}
X-Immutable-Signature header.
Querying Alerts
Retrieve triggered alerts via the API:Plan Quotas
| Plan | Alert Rule Limit |
|---|---|
| Free | 2 |
| Starter | 10 |
| Pro | 50 |
| Enterprise | Unlimited |