Common Configurations

Severity

Every alert is assigned a severity level, either set manually or determined automatically by the detector.

Level	Meaning
`CRITICAL`	Immediate reaction required — treat as an active incident
`HIGH`	Dangerous event that needs prompt attention and resolution
`MEDIUM`	Important or suspicious event worth investigating
`LOW`	Informational event that may provide useful insights or metrics
`INFO`	Progress or state notification only
`Auto`	Detector chooses severity based on its own logic; overriding this forces all alerts to the selected level

When a detector is set to Auto, it may emit alerts at different severity levels depending on conditions. Overriding forces a fixed level across all alerts from that detector.

Cron Schedule

Controls how frequently a detector evaluates. Three formats are accepted:

Human readable
Quartz cron
Milliseconds

Plain-language intervals — easiest to read and configure.

min
day
hours
seconds

Full Quartz cron expression syntax for precise scheduling.

0 12 * * ?       every day at noon
0/5 * * * ?      every 5 minutes
0 0 ? * MON-FRI  weekdays at midnight

Raw millisecond interval — useful for programmatic configuration via the API.

60000     1 minute
3600000   1 hour
86400000  1 day

Condition (Threshold)

Conditions control when a detector fires based on a numeric value. The syntax supports basic comparisons, percentage changes, delta operations, and edge-detection operators.

Basic comparison

Standard numeric comparison against a fixed value.

= 100     fires when value equals 100
!= 100    fires when value does not equal 100
> 50      fires when |value| > 50
< 25      fires when |value| < 25
>= 35     fires when |value| >= 35
<= 50     fires when |value| <= 50

Operators >, <, >=, <= apply absolute value handling by default. Prefix with + or - to compare exact signed values instead.

Explicit sign (no absolute value)

Prefix the threshold with + or - to skip absolute value handling and compare the exact signed value.

> +10     fires when value > 10 (exact, positive only)
> -15     fires when value > -15
< +30     fires when value < 30
< -20     fires when value < -20

Percentage change

Fires based on the percentage change from the previous value. Formula: (v - v₀) / v₀ × 100.

> 25%     change > 25%
< 10%     change < 10%
>= 50%    change >= 50%
= 100%    exact 100% change

Example: if v₀ = 1000 and v = 700, the change is -30%.

Delta (absolute change)

Fires based on the absolute change from the previous value using ++ (increase) or -- (decrease).

> ++100    increase greater than 100
< --50     decrease greater than 50
>= ++30    increase of at least 30
= ++20     increase of exactly 20

Once operators (edge detection)

>> and << variants fire only once when a condition transitions from false to true. Subsequent evaluations return false even if the condition remains true — useful for detecting threshold crossings without repeated alerts.

>> 10     fires once when value crosses above 10
<< 25     fires once when value crosses below 25
>>= 10    fires once when value reaches or exceeds 10
<<= 25    fires once when value reaches or falls below 25
>> ++100  fires once when increase crosses 100
>> 25%    fires once when percentage change crosses 25%

Max/Min operators

>>> and <<< variants fire only when a new all-time maximum or minimum is reached above/below the threshold.

>>> 100    new maximum above 100
<<< 50     new minimum below 50
>>>= 100   new maximum at or above 100
<<<= 50    new minimum at or below 50

Example for >>> 100:

Value	Fires?	Reason
90	No	Below threshold
200	Yes	First value exceeding 100
150	No	Above 100 but below previous max (200)
300	Yes	New maximum
200	No	Below current max (300)

Spaces in condition expressions are ignored — > ++ 100 and >++100 are equivalent.

Getting Started

Security Monitoring

Advanced Monitoring

Compliance Monitoring

Financial Monitoring

Beta Features

Smart Contract Actions

Legal

Common Configurations

Severity

Cron Schedule

Condition (Threshold)

​Severity

​Cron Schedule

​Condition (Threshold)

Severity

Cron Schedule

Condition (Threshold)