Alerts overview
Detect important incoming events and Analytics results with governed rules and durable Incidents.
Alerts add detection to the same governed path that validates events and runs Analytics APIs. Core owns rules, state, Incidents, Notification Channels, authorization, limits, audit, and delivery.
Ingest → Validate → Normalize → Detect → Dispatch → Warehouse
↘ Incident → Notification
An Alert failure does not reject an otherwise valid ingest request or stop warehouse delivery. Notification providers never run in the ingest request path.
Two trigger types
Both trigger types create the same durable resources:
- An Alert is the governed rule.
- An Incident is one open, acknowledged, or resolved lifecycle for a rule and deterministic group.
- An Occurrence records a timestamp, event reference when available, and bounded selected fields. The warehouse remains the full-history source of truth.
- A Notification Channel is a reusable Email, Generic Webhook, Slack, or Microsoft Teams destination.
The first qualifying match opens or merges an Incident and queues its notification immediately. The minimum 300-second cooldown is a repeat-notification interval for that active Incident, not a detection delay. Core coalesces pending work and applies database-coordinated project and channel rate limits so a burst of matching events updates one Incident instead of creating a notification storm.
Start in the Console
Open Insights → Alerts, then select Create Alert. The builder loads Data Models, Analytics APIs, fields, operators, and Notification Channels from the current project. Data Model and Analytics detail pages also provide a Create Alert shortcut.
Use Test Rule for an Event Alert sample. Simulation returns matched, a result for each condition, deterministic group context, and selected safe fields. It never opens an Incident or sends a notification.
Public Dataset workflow
On a public Dataset page, Watch this data preserves the Dataset slug through sign-in and project selection. The Console connects the read-only Dataset before opening the Alert builder with the Dataset binding and shared model selected. The Alert belongs to the consumer project; the Data application does not run a separate alert engine.
Assistant workflow
The Assistant can safely list and inspect Alerts, Incidents, Notification Channels, and deliveries. Creates, updates, enable/disable, acknowledge/resolve, retry, and Send Test use the Core-owned structured confirmation flow. Event Alert creation requires a sample event that passes side-effect-free draft simulation before confirmation. The Assistant may create Email channels and attach any existing channel to an Alert. Existing secrets are never sent to the model; secret-bearing webhook, Slack, and Teams configuration stays in the secure Console form.
See Event Alerts, Analytics Alerts, Incidents, and Notification Channels.