Skip to main content
An alert rule connects an event or condition to a notification channel. Configure what triggers, add filters, pick the destination.

​
Rule anatomy

  • Trigger — the event or condition.
  • Filter — narrow to specific Flows, tenants, cost thresholds, etc.
  • Channel — where the notification goes (see Channels).
  • Template — customize the message body.
  • Rate limit — cap notifications per unit time (prevent floods).

​
Trigger types

​
Event triggers

Fire on discrete events:
  • Flow publish — a new version was published.
  • Flow rollback — a rollback happened (usually high-priority).
  • Auto-rollback — automatic rollback triggered (near-emergency).
  • Approval requested — a new approval is waiting.
  • Approval decided — an approval was approved or rejected.
  • Secret rotated — a connector or provider key was rotated.
  • Member role changed — access change.
  • Improvement deployed — an improvement shipped.

​
Threshold triggers

Fire when a metric crosses a threshold, sustained over a window:
  • Signal rate — signals per hour above threshold.
  • Error rate — trace errors per hour above threshold.
  • Verdict rate — NOT_SUPPORT rate exceeds threshold.
  • Cost per run — average cost exceeds threshold.
  • Cost per day — total daily cost exceeds threshold.
  • Latency p95 — p95 latency above threshold.
  • Retrieval hit rate — proportion of retrievals with zero hits.
Threshold triggers require sustained crossings (e.g., “above X for 15 minutes”). Prevents single-spike false alarms.

​
Pattern triggers

Fire on specific patterns Nora detects:
  • Regression — a fixed cluster reappears.
  • New cluster — a new signal cluster forms with 5+ signals.
  • Sustained cluster growth — an existing cluster gains 10+ signals in a day.

​
Silence triggers

Fire when something you expect to happen doesn’t:
  • Missed schedule — a scheduled Trigger didn’t fire.
  • No traces — Flow received no runs for N hours (upstream broken?).
  • Feedback silent — no feedback submitted for N days on a Flow with active runs (QA reviewing?).

​
Adding a rule

Settings → Notifications → Alerts → New:
  1. Pick a trigger type.
  2. Configure the trigger’s specifics.
  3. Add filters (Flow, tenant, cost bucket, etc.).
  4. Pick a channel.
  5. Set a rate limit (defaults to 1 notification per 5 minutes per rule).
  6. Save.
Rules are enabled by default. Toggle to disable without deleting.

​
Filters

Every rule accepts filters:
  • Flow — specific Flow slug or “any Flow”.
  • Version — a specific published version.
  • Tenant — a specific tenant (for multi-tenant workloads).
  • Environment — Prod / Staging / Dev (via workspace tag).
  • Feature — a custom feature flag on the trace.
Filters compose with AND semantics.

​
Templates

Default templates are sensible. Customize when you want:
  • A specific format (matching your ticketing system’s expected input).
  • Extra context (link to the trace, link to the audit entry).
  • Localized language.
Template variables include actor, target, action-specific fields, workspace URL.

​
Rate limits

Every rule has a rate limit. Default: 1 notification per 5 minutes per rule.
  • Prevents flapping thresholds from spamming your Slack.
  • Groups clustered events into a single “5 events in the last 5 minutes” summary.
Turn off rate limit only for genuine emergency triggers (auto-rollback, critical error rate).

​
Muting

Any rule can be temporarily muted:
  • Mute for 1 hour — during a planned deploy or investigation.
  • Mute indefinitely — when the rule is over-firing and needs review. Notifications will resume after the mute is lifted or the rule is deleted.

​
Rule dependencies

For complex flows, chain rules:
  • When rule A fires, mute rule B for 30 minutes — prevent alert storms.
  • When rule A fires and is unacknowledged for 15 minutes, escalate to rule C — page on-call after Slack goes ignored.
Configure under Rule → Dependencies.

​
Testing

Every rule has a Test button. Fires a fake event through the whole pipeline (filters + template + channel) so you can verify end-to-end wiring without waiting for a real trigger.

​
Common alert patterns

​
Basic operational

​
Quality thresholds

​
Regressions

Regressions are high-priority — worth both channels and no rate limit.

​
Audit

Every alert rule change (create, edit, mute, delete) is audited.