Alerts Reference — Aurora Sentinel

Sentinel generates alerts when monitored conditions are met. This page documents alert types, delivery channels, and how to customise alert rules.

Built-in alert types

Security alerts

Alert	Description	Default severity
`failed_logins`	Repeated failed login attempts from a single source	high
`credential_exposure`	Credentials detected in configuration or logs	critical
`permission_escalation`	Unexpected privilege escalation detected	critical
`api_key_rotation_overdue`	API key has not been rotated in 90+ days	medium

Availability alerts

Alert	Description	Default severity
`target_unreachable`	Monitored instance is not responding	high
`response_time_high`	Response time exceeds threshold	medium
`cert_expiry`	TLS certificate expiring within 14 days	medium

Audit alerts

Alert	Description	Default severity
`config_drift`	Configuration has changed since last snapshot	high
`audit_log_gap`	Gap detected in audit log sequence	critical

Delivery channels

Email

alerts:
  channels:
    - type: email
      to: ops@example.com
      from: sentinel@example.com

Requires SMTP_HOST, SMTP_USER, and SMTP_PASS environment variables.

Slack

alerts:
  channels:
    - type: slack
      webhook_url: ${SLACK_WEBHOOK_URL}

PagerDuty

alerts:
  channels:
    - type: pagerduty
      integration_key: ${PAGERDUTY_KEY}

Generic webhook

alerts:
  channels:
    - type: webhook
      url: https://your-endpoint.example.com/alerts
      headers:
        Authorization: Bearer ${WEBHOOK_TOKEN}

Custom alert rules

Add custom rules to your sentinel.yml:

rules:
  - name: high_error_rate
    condition: error_rate > 0.05
    window: 60s
    severity: high
    message: "Error rate above 5% for 60 seconds"

Silencing alerts

To silence a specific alert type during maintenance:

Open the Sentinel web UI.
Go to Alerts → Silence Rules.
Click New Silence, set the duration and alert type.

Alternatively, set MAINTENANCE_MODE=true to silence all non-critical alerts temporarily.