> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> A prioritized feed of high-signal security events across your organization

Alerts is Ultra Hub's security operations feed. It gathers the high-signal events from across your organization, guardrail enforcement and governance blocks, into one prioritized list, so you don't have to reconstruct what happened by reading the audit log.

Open it from **Alerts** in the Hub sidebar, or go directly to `/alerts`.

## Alert Sources

The **Type** column tells you which system produced an alert.

| Type           | What it alerts on                                                    |
| -------------- | -------------------------------------------------------------------- |
| **Guardrail**  | A guardrail blocked or redacted a request.                           |
| **Governance** | An attempt to reach a server your governance policy does not permit. |

### Guardrail Alerts

Guardrail alerts cover enforcement that was actually applied: a request that was blocked, or a response that was redacted. The alert names the tool or server involved.

<Warning>
  A guardrail set to **Alert** enforcement mode does not produce an alert in this feed. Alert mode allows the request and records it in the audit log. The Alerts feed covers enforcement that was applied, meaning a block or a redaction. See [Enforcement modes](/hub/guardrails#enforcement-modes).
</Warning>

### Governance Alerts

Governance alerts cover blocked attempts to reach a server your governance policy does not permit. The alert names the blocked server.

Every enforcement event is recorded in the [audit log](/observability/audit-log) whether or not it raises an alert.

## Severity

| Level             | Meaning                                       |
| ----------------- | --------------------------------------------- |
| **Critical**      | Investigate immediately.                      |
| **High**          | Suspicious or persistent; review recommended. |
| **Medium**        | Unusual; worth a look.                        |
| **Low**           | Routine.                                      |
| **Informational** | Context only.                                 |

Ultra assigns severity, so an alert means the same thing across every organization. There is nothing to configure to start receiving alerts.

## The Alerts Page

### Summary Banner

A strip across the top of the page counts every alert in your organization. It is not affected by the filters applied to the table below it.

| Tile                                               | What it shows                                                           |
| -------------------------------------------------- | ----------------------------------------------------------------------- |
| **Total**                                          | Every alert in the organization.                                        |
| **Last 24h**                                       | Alerts raised in the last 24 hours.                                     |
| **Critical / High / Medium / Low / Informational** | Count per severity, with non-zero counts colored to match the severity. |

### The Feed

The table lists alerts newest first.

| Column       | Description                                                                                   |
| ------------ | --------------------------------------------------------------------------------------------- |
| **Severity** | Severity badge. Filterable.                                                                   |
| **Alert**    | The alert title. Searchable.                                                                  |
| **Type**     | The producing source. Filterable.                                                             |
| **Context**  | The affected entity, such as a tool or a server. Server contexts link through to that server. |
| **Time**     | When the alert was raised, in UTC. Filterable by time range.                                  |

A filtered view is shareable by URL. The feed refreshes on its own, so new alerts appear without reloading the page.

If your organization has never had an alert, the page shows an empty state rather than an empty table. An empty table below an active filter means that filter matched nothing, not that you have no alerts.

### Unread Alerts

Alerts you have not opened yet are marked as unread in the feed, and the Alerts item in the sidebar carries a count of how many are waiting. Opening an alert clears its marker and lowers the count.

Read state is per person. A teammate opening an alert does not clear it for you, and the count on your sidebar always reflects what *you* have not yet looked at.

### Alert Detail

Clicking a row opens a drawer with the full record: what happened in plain language, the affected entity, when it happened, and a recommended next step.

The drawer is linkable. Opening an alert adds `?alert=<id>` to the URL, and that link opens straight to the same alert, so you can hand a specific alert to a teammate.

<Note>
  **Alerts never carry raw matched content.** The credential, secret, or PII value that caused a guardrail to fire is never stored on the alert or shown in the feed. To investigate the underlying request, follow the [audit log](/observability/audit-log).
</Note>

## Scope

Alerts are **organization-scoped**. Every member of an organization sees the same feed, regardless of workspace membership.