
What it is
Each alert rule carries a condition tree that is evaluated every time an alert is generated in your workspace. If the conditions match, the rule fires and sends a notification using either the workspace default template or a custom template you attach to the rule. A built-in condition tester lets you validate a rule against a sample alert before saving, so you never push an untested rule to production.When to use it
- Page on-call only for
criticalseverity alerts on certificates taggedprod. - Route
renewal.failedevents to a Slack channel watched by the platform team, while routing generalcertificate.expiringevents to email. - Suppress low-severity alerts for certificates already in a planned-decommission workflow.
- Fire a webhook when any wildcard certificate is within 7 days of expiry.
- Alert a compliance inbox any time a certificate tagged
pcichanges status.
Set it up
Build the condition tree
Use the visual tree builder to add condition nodes. Each leaf compares a field on the alert (such as
severity, type, metadata.daysUntilExpiry, or certificate.tags) to a value using operators like equals, contains, greater than, or regex. Combine leaves with All of (AND), Any of (OR), or Not wrappers.Test the condition
Click Test condition to open the tester panel. Fill in a sample alert and click Run to see whether the tree matches. Adjust and re-test until the preview matches your intent — no rule is saved until you click Save.
Set the notification template (optional)
Toggle Custom notification template if this rule should send a different message body than the workspace default. Edit the template using the same Handlebars-style variables available across the platform.
What you’ll see
Active alerts appear on Monitoring > Alerts with severity badges and the rule name that fired them. Click Acknowledge or Resolve directly from the list. Each alert row expands to show the full condition that matched and the notification channels that were notified.Tips
- Use the
certificate.tagsfield to limit a rule to a subset of your inventory rather than alerting on every certificate in the workspace. - A rule with no condition tree matches every alert — useful as a catch-all fallback routed to a low-priority channel.
- The condition tester does not save the rule. You can safely iterate without affecting live alerts.
Related
Alerts
The base alert model, suppression windows, and escalation rules.
Notifications
Channels and templates that rules reference.
Certificate Tags
Use tags in condition trees to target specific certificate groups.