Overview
Alert rules monitor your event stream in real time and trigger notifications when specific conditions are met. Configure rules from Settings > Alerts in the dashboard.Rule Types
Immutable provides five built-in alert rule types:new_country
Triggers when an actor performs an action from a country they have never been seen in before. Requires geolocation enrichment.
Use case: Detect potential account compromise. A user who normally logs in from the US suddenly appears from an unrecognized country.
high_volume_destructive
Triggers when a high volume of destructive actions (e.g. *.deleted, *.removed) occurs within a short time window.
Use case: Detect mass deletion attacks or accidental bulk operations.
ingestion_spike
Triggers when event ingestion volume exceeds a configurable threshold relative to the workspace’s normal baseline.
Use case: Detect unusual API activity that may indicate a compromised API key or a misconfigured integration.
repeated_action
Triggers when the same action is performed repeatedly by the same actor within a short time window.
Use case: Detect brute-force login attempts, automated scraping, or retry loops.
off_hours
Triggers when actions occur outside of configured business hours.
Use case: Detect suspicious activity during nights, weekends, or holidays.
Alert Delivery
Alerts are delivered through two channels:Webhook
Alerts are POSTed to your configured endpoint as JSON with HMAC-SHA256 signature verification. Headers:Content-Type: application/jsonX-Immutable-Signature: sha256={hmac_hash}
X-Immutable-Signature header.