Configure alert channels and manage your notification inbox

Set up Slack, email, and webhook notification channels, configure severity thresholds and routing rules, and manage the InfraAudit alert inbox.

Alerts are user-facing notifications about findings that need attention. InfraAudit creates them automatically from drift detections, vulnerability scans, cost anomalies, and compliance failures. You can also create manual alerts when needed.

Alert types and sources

Type	Generated from
Security	Drifts (configuration and security types), critical/high vulnerabilities
Cost	Cost anomalies and budget threshold breaches
Compliance	Failed controls during an assessment run
Performance	Resource utilization anomalies

Alert list

In the sidebar, click Alerts. The inbox shows all open alerts, newest first.

Column	Description
Title	Short description of what triggered the alert
Type	Security, cost, compliance, or performance
Severity	Critical, high, medium, or low
Resource	The affected resource
Created	Timestamp
Status	Open, acknowledged, or resolved

Use the filter bar to narrow by type, severity, provider, or status.

Managing alerts

Acknowledge

Acknowledging an alert marks it as seen but leaves it open. It stays in the list until resolved — useful in on-call workflows where you want to signal “I’m looking at this” to teammates.

Click Acknowledge in the alert row, or:

infraudit alert acknowledge <alert-id>

Resolve

Resolving closes the alert. Do this once the underlying issue is fixed. If you resolve a drift alert, InfraAudit also prompts you to mark the underlying drift as resolved.

infraudit alert resolve <alert-id>

Bulk actions

Select multiple alerts with the checkboxes and use the Bulk actions dropdown to acknowledge or resolve them all at once. This is useful for clearing a backlog after a maintenance window.

Notification channels

Alerts are delivered to channels you configure under Settings → Notifications:

Slack

Add your Slack webhook URL under Settings → Notifications → Slack (SaaS) or set SLACK_WEBHOOK_URL in .env (self-hosted). Then choose which alert types to route to each channel.

You can configure multiple Slack channels for different severities — for example, #security-critical for critical alerts and #infra-alerts for everything else.

Email

Add email addresses under Settings → Notifications → Email. InfraAudit sends a formatted email for each alert that matches your routing rules.

Webhook

Add HTTP endpoints under Settings → Webhooks. InfraAudit POSTs a signed JSON payload to each configured endpoint for matching events. Payloads are signed with HMAC-SHA256 so your receiver can verify authenticity.

Alert routing rules

Routing rules let you target different channels for different severities or alert types. Configure them under Settings → Notifications → Routing. Examples:

• Critical security alerts → #security-critical Slack channel
• All cost anomalies → FinOps email list
• All events → audit webhook endpoint

Alert history

Resolved alerts move to the History tab. History is retained for 90 days on Starter and Professional plans, and 1 year on Enterprise.

CLI reference

# List all open alerts
infraudit alert list

# Filter by severity
infraudit alert list --severity critical

# Acknowledge an alert
infraudit alert acknowledge <alert-id>

# Resolve an alert
infraudit alert resolve <alert-id>

# Output as JSON for scripting
infraudit alert list -o json | jq '.[].title'

Next steps

• Remediation — act on security alerts by applying automated fixes
• Drift detection — understand the drift findings that generate security alerts
• Cost optimization — understand the anomalies that generate cost alerts