Alert rules
Configure automated alerts for Shadow AI events and review alert history.
Overview
The Rules page lets you set up alerts for Shadow AI activity. Rules are checked each time a batch of events arrives through the REST API or syslog. When a rule's condition is met, VerifyWise records an alert and, if you chose to be notified, sends you an in-app notification and an email.
Rules tab
The default view shows your alert rules as cards. Each card shows the rule name, trigger type, its threshold or departments, the cooldown, whether it notifies anyone and an on/off toggle. Rules cannot be edited after creation; to change one, delete it and create a new one.
You can enable or disable a rule at any time using the toggle switch. Disabled rules do not fire alerts but are preserved for future use.
Creating a rule
Click "Create rule" to open the creation modal. Fill in the following fields:
- Rule name: A descriptive name (required)
- Description: Optional notes about the rule's purpose
- Trigger type: The condition that fires the alert (see below)
- Configuration: Threshold or parameters specific to the trigger type
- Cooldown period: How long the rule stays quiet for the same tool, department or user after it fires (see below).
- Notify me: On by default. Sends you an in-app notification and an email when the rule fires. Only the person who creates the rule is notified; with this off, alerts appear in the alert history only
- Active: Whether the rule is checked from the moment it is created
Trigger types
Each rule monitors one type of event. The available triggers are:
New tool detected
Fires when a batch of events contains an AI tool seen for the first time.
Usage threshold exceeded
Fires when new events arrive for a tool whose total event count has reached the threshold.
Sensitive department usage
Fires when events arrive from one of the departments you list (matched without regard to case).
Blocked tool attempt
Fires when your proxy reports a blocked request (action blocked) to a tool whose status is Blocked.
- Risk score exceeded: Fires when new events arrive for a tool whose current risk score is at or above the minimum you set (default 70). Scores are recalculated nightly, so a tool without a score yet does not fire.
- New user detected: Fires the first time a user is observed accessing any AI tool. Earlier traffic from that user that matched no AI tool does not count, so it does not stop the alert.
Understanding usage thresholds
The usage threshold is the total number of events recorded for one AI tool across all users (default 100). Once a tool reaches it, the rule fires whenever new events for that tool arrive, at most once per cooldown period.
Understanding risk score triggers
The risk score (0-100) is calculated nightly using a weighted formula: approval status (40%), data and compliance policies (25%), usage volume (15%) and department sensitivity (20%). Unapproved tools with weak compliance posture used by sensitive departments score highest. The rule is checked when new events for a tool arrive, not when the score changes.
Deleting a rule
Click the trash icon on a rule card to delete it. You will be asked to confirm. Deleting a rule removes the rule but keeps its alerts in the alert history, under the rule's name.
Cooldowns and alert batching
To prevent alert fatigue, each rule has a configurable cooldown period and the system enforces a per-batch alert cap.
Per-rule cooldown
When you create a rule, you select a cooldown period that controls the minimum time between repeated alerts for the same trigger context (e.g., the same tool or the same user). If a rule fires for a given context, it will not fire again for that same context until the cooldown expires.
| Cooldown option | Behavior |
|---|---|
| 1 hour | Alert suppressed for the same context for 60 minutes after firing |
| 6 hours | Alert suppressed for the same context for 6 hours after firing |
| 12 hours | Alert suppressed for the same context for 12 hours after firing |
| 24 hours (default) | Alert suppressed for the same context for 24 hours after firing |
The "context" that determines deduplication depends on the trigger type: for tool-based triggers (new tool detected, usage threshold, blocked attempt, risk score exceeded), the cooldown applies per tool per rule. For sensitive department triggers, it applies per department per rule. For new user detected, it applies per user email per rule. Within one batch of events, a Blocked tool attempt rule fires at most once per tool, however many blocked requests the batch holds.
Per-batch alert cap
As a safety net, at most 50 alerts can fire for one batch of events. Alerts beyond 50 are dropped without a record in the alert history. This prevents a flood of notifications from a misconfigured rule or a sudden traffic spike.
Alert history tab
Switch to the "Alert history" tab to see the alerts your rules have fired, newest first. The table shows:
- Rule: Name of the rule that fired
- Trigger: The trigger type that caused the alert
- Fired at: Timestamp of when the alert was triggered
Clicking a column header sorts the rows on the current page. Alerts are kept for the period set under alert history retention in Settings.