> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Alert rules

> What triggers a notification — thresholds, patterns, and events.

An **alert rule** connects an event or condition to a notification channel. Configure what triggers, add filters, pick the destination.

## Rule anatomy

* **Trigger** — the event or condition.
* **Filter** — narrow to specific Flows, tenants, cost thresholds, etc.
* **Channel** — where the notification goes (see [Channels](/settings/notifications/channels)).
* **Template** — customize the message body.
* **Rate limit** — cap notifications per unit time (prevent floods).

## Trigger types

### Event triggers

Fire on discrete events:

* **Flow publish** — a new version was published.
* **Flow rollback** — a rollback happened (usually high-priority).
* **Auto-rollback** — automatic rollback triggered (near-emergency).
* **Approval requested** — a new approval is waiting.
* **Approval decided** — an approval was approved or rejected.
* **Secret rotated** — a connector or provider key was rotated.
* **Member role changed** — access change.
* **Improvement deployed** — an improvement shipped.

### Threshold triggers

Fire when a metric crosses a threshold, sustained over a window:

* **Signal rate** — signals per hour above threshold.
* **Error rate** — trace errors per hour above threshold.
* **Verdict rate** — NOT\_SUPPORT rate exceeds threshold.
* **Cost per run** — average cost exceeds threshold.
* **Cost per day** — total daily cost exceeds threshold.
* **Latency p95** — p95 latency above threshold.
* **Retrieval hit rate** — proportion of retrievals with zero hits.

Threshold triggers require sustained crossings (e.g., "above X for 15 minutes"). Prevents single-spike false alarms.

### Pattern triggers

Fire on specific patterns Nora detects:

* **Regression** — a fixed cluster reappears.
* **New cluster** — a new signal cluster forms with 5+ signals.
* **Sustained cluster growth** — an existing cluster gains 10+ signals in a day.

### Silence triggers

Fire when something you expect to happen doesn't:

* **Missed schedule** — a scheduled Trigger didn't fire.
* **No traces** — Flow received no runs for N hours (upstream broken?).
* **Feedback silent** — no feedback submitted for N days on a Flow with active runs (QA reviewing?).

## Adding a rule

**Settings → Notifications → Alerts → New**:

1. Pick a trigger type.
2. Configure the trigger's specifics.
3. Add filters (Flow, tenant, cost bucket, etc.).
4. Pick a channel.
5. Set a rate limit (defaults to 1 notification per 5 minutes per rule).
6. Save.

Rules are enabled by default. Toggle to disable without deleting.

## Filters

Every rule accepts filters:

* **Flow** — specific Flow slug or "any Flow".
* **Version** — a specific published version.
* **Tenant** — a specific tenant (for multi-tenant workloads).
* **Environment** — Prod / Staging / Dev (via workspace tag).
* **Feature** — a custom feature flag on the trace.

Filters compose with AND semantics.

## Templates

Default templates are sensible. Customize when you want:

* A specific format (matching your ticketing system's expected input).
* Extra context (link to the trace, link to the audit entry).
* Localized language.

Template variables include actor, target, action-specific fields, workspace URL.

## Rate limits

Every rule has a rate limit. Default: 1 notification per 5 minutes per rule.

* Prevents flapping thresholds from spamming your Slack.
* Groups clustered events into a single "5 events in the last 5 minutes" summary.

Turn off rate limit only for genuine emergency triggers (auto-rollback, critical error rate).

## Muting

Any rule can be temporarily muted:

* **Mute for 1 hour** — during a planned deploy or investigation.
* **Mute indefinitely** — when the rule is over-firing and needs review. Notifications will resume after the mute is lifted or the rule is deleted.

## Rule dependencies

For complex flows, chain rules:

* **When rule A fires, mute rule B for 30 minutes** — prevent alert storms.
* **When rule A fires and is unacknowledged for 15 minutes, escalate to rule C** — page on-call after Slack goes ignored.

Configure under **Rule → Dependencies**.

## Testing

Every rule has a **Test** button. Fires a fake event through the whole pipeline (filters + template + channel) so you can verify end-to-end wiring without waiting for a real trigger.

## Common alert patterns

### Basic operational

```
Rule: Auto-rollback
Trigger: auto_rollback_fired
Channel: PagerDuty (nora-oncall)
Rate limit: none
```

```
Rule: Publish notification
Trigger: flow_publish
Filter: any Flow
Channel: Slack (#nora-deploys)
Rate limit: 1/5min
```

```
Rule: Approval requests
Trigger: approval_requested
Filter: any Flow
Channel: Slack (#nora-approvals)
Template: Slack card with Approve / Reject buttons
Rate limit: none
```

### Quality thresholds

```
Rule: NOT_SUPPORT spike
Trigger: verdict_rate > 5%
Window: 30 minutes
Filter: Flow = support-agent
Channel: Slack (#support-oncall)
Rate limit: 1/hour
```

```
Rule: Cost per run high
Trigger: cost_per_run avg > $0.20
Window: 1 hour
Filter: any Flow
Channel: Email (finance@)
Rate limit: 1/day
```

### Regressions

```
Rule: Regression
Trigger: regression_detected
Filter: any Flow
Channel: Slack (#nora-alerts) + PagerDuty
Rate limit: none
```

Regressions are high-priority — worth both channels and no rate limit.

## Audit

Every alert rule change (create, edit, mute, delete) is audited.

## Related

* [Channels](/settings/notifications/channels) — where notifications go.
* [Regressions](/reliable/signals/regressions) — the pattern trigger for previously-fixed issues.
* [Cost & latency](/reliable/traces/cost) — the metrics behind threshold triggers.
* [Approve & deploy](/reliable/optimization/approve) — approval workflow.