/alerts.
Alert Sources
The Type column tells you which system produced an alert.Guardrail Alerts
Guardrail alerts cover enforcement that was actually applied: a request that was blocked, or a response that was redacted. The alert names the tool or server involved.Governance Alerts
Governance alerts cover blocked attempts to reach a server your governance policy does not permit. The alert names the blocked server. Every enforcement event is recorded in the audit log whether or not it raises an alert.Severity
Ultra assigns severity, so an alert means the same thing across every organization. There is nothing to configure to start receiving alerts.
The Alerts Page
Summary Banner
A strip across the top of the page counts every alert in your organization. It is not affected by the filters applied to the table below it.The Feed
The table lists alerts newest first.
A filtered view is shareable by URL. The feed refreshes on its own, so new alerts appear without reloading the page.
If your organization has never had an alert, the page shows an empty state rather than an empty table. An empty table below an active filter means that filter matched nothing, not that you have no alerts.
Unread Alerts
Alerts you have not opened yet are marked as unread in the feed, and the Alerts item in the sidebar carries a count of how many are waiting. Opening an alert clears its marker and lowers the count. Read state is per person. A teammate opening an alert does not clear it for you, and the count on your sidebar always reflects what you have not yet looked at.Alert Detail
Clicking a row opens a drawer with the full record: what happened in plain language, the affected entity, when it happened, and a recommended next step. The drawer is linkable. Opening an alert adds?alert=<id> to the URL, and that link opens straight to the same alert, so you can hand a specific alert to a teammate.
Alerts never carry raw matched content. The credential, secret, or PII value that caused a guardrail to fire is never stored on the alert or shown in the feed. To investigate the underlying request, follow the audit log.