> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure alert channels and manage your notification inbox

> Set up Slack, email, and webhook notification channels, configure severity thresholds and routing rules, and manage the InfraAudit alert inbox.

Alerts are user-facing notifications about findings that need attention. InfraAudit creates them automatically from drift detections, vulnerability scans, cost anomalies, and compliance failures. You can also create manual alerts when needed.

## Alert types and sources

| Type            | Generated from                                                           |
| --------------- | ------------------------------------------------------------------------ |
| **Security**    | Drifts (configuration and security types), critical/high vulnerabilities |
| **Cost**        | Cost anomalies and budget threshold breaches                             |
| **Compliance**  | Failed controls during an assessment run                                 |
| **Performance** | Resource utilization anomalies                                           |

## Alert list

In the sidebar, click **Alerts**. The inbox shows all open alerts, newest first.

| Column       | Description                                   |
| ------------ | --------------------------------------------- |
| **Title**    | Short description of what triggered the alert |
| **Type**     | Security, cost, compliance, or performance    |
| **Severity** | Critical, high, medium, or low                |
| **Resource** | The affected resource                         |
| **Created**  | Timestamp                                     |
| **Status**   | Open, acknowledged, or resolved               |

Use the filter bar to narrow by type, severity, provider, or status.

## Managing alerts

### Acknowledge

Acknowledging an alert marks it as seen but leaves it open. It stays in the list until resolved — useful in on-call workflows where you want to signal "I'm looking at this" to teammates.

Click **Acknowledge** in the alert row, or:

```bash theme={null}
infraudit alert acknowledge <alert-id>
```

### Resolve

Resolving closes the alert. Do this once the underlying issue is fixed. If you resolve a drift alert, InfraAudit also prompts you to mark the underlying drift as resolved.

```bash theme={null}
infraudit alert resolve <alert-id>
```

### Bulk actions

Select multiple alerts with the checkboxes and use the **Bulk actions** dropdown to acknowledge or resolve them all at once. This is useful for clearing a backlog after a maintenance window.

## Notification channels

Alerts are delivered to channels you configure under **Settings → Notifications**:

<Tabs>
  <Tab title="Slack">
    Add your Slack webhook URL under **Settings → Notifications → Slack** (SaaS) or set `SLACK_WEBHOOK_URL` in `.env` (self-hosted). Then choose which alert types to route to each channel.

    You can configure multiple Slack channels for different severities — for example, `#security-critical` for critical alerts and `#infra-alerts` for everything else.
  </Tab>

  <Tab title="Email">
    Add email addresses under **Settings → Notifications → Email**. InfraAudit sends a formatted email for each alert that matches your routing rules.
  </Tab>

  <Tab title="Webhook">
    Add HTTP endpoints under **Settings → Webhooks**. InfraAudit POSTs a signed JSON payload to each configured endpoint for matching events. Payloads are signed with HMAC-SHA256 so your receiver can verify authenticity.
  </Tab>
</Tabs>

## Alert routing rules

Routing rules let you target different channels for different severities or alert types. Configure them under **Settings → Notifications → Routing**. Examples:

* Critical security alerts → `#security-critical` Slack channel
* All cost anomalies → FinOps email list
* All events → audit webhook endpoint

## Alert history

Resolved alerts move to the **History** tab. History is retained for 90 days on Starter and Professional plans, and 1 year on Enterprise.

## CLI reference

```bash theme={null}
# List all open alerts
infraudit alert list

# Filter by severity
infraudit alert list --severity critical

# Acknowledge an alert
infraudit alert acknowledge <alert-id>

# Resolve an alert
infraudit alert resolve <alert-id>

# Output as JSON for scripting
infraudit alert list -o json | jq '.[].title'
```

## Next steps

* [Remediation](/platform/remediation) — act on security alerts by applying automated fixes
* [Drift detection](/platform/drift-detection) — understand the drift findings that generate security alerts
* [Cost optimization](/platform/cost-optimization) — understand the anomalies that generate cost alerts