Alert rules

Rules that watch for something and fire when it happens. On paid plans.

Read this page before relying on them. Alert rules are real and evaluated, but the delivery side is not finished: there is no panel for them yet, and no per-rule destination you can point at yourself. What follows describes exactly what works today.

#What a rule is

A named condition on one of five kinds of event:

Type	Fires when	Condition
`cve_severity`	a CVE lookup returns a score at or above your floor	`{ "cvss_min": 7.5 }`
`news_risk`	a news item is scored at or above your floor	`{ "risk_min": 6 }`
`sanctions_match`	a sanctions search returns any match	`{}`, or `{ "schema": "Person" }`
`entity_alert`	a specific entity is touched	`{ "entity_id": "…" }`
`space_event`	a solar flare, geomagnetic storm or asteroid approach	`{ "event_type": "flare" }`

One honest caveat inside the table itself: nothing in the product currently emits an entity_alert event, so a rule of that type validates and stores but will never fire. The other four types do receive events.

Rules are evaluated as events arrive — a CVE or sanctions lookup, a news item ingested, a space event detected. Storage and management are per-account: only you can see or edit your rules. Evaluation is not: a cve_severity or sanctions_match rule is checked against matching lookups from any account, not only your own, because those events carry no account today.

#Managing them

Over HTTP, using your signed-in browser session. There is no UI yet.

GET    /api/alert-rules            list your rules
POST   /api/alert-rules            create one
PATCH  /api/alert-rules?id=<uuid>  enable or disable it
DELETE /api/alert-rules?id=<uuid>  remove it

PATCH takes { "enabled": true | false } and nothing else — a rule's condition is not editable in place. To change one, delete it and create it again.

Creating one:

{
  "name": "Critical CVEs",
  "type": "cve_severity",
  "condition": { "cvss_min": 9.0 },
  "channels": ["webhook"],
  "enabled": true
}

Reading your own rules needs nothing but a session. Creating, editing and deleting need a paid plan.

#Delivery — the honest state of it

webhook is the only channel that exists. Email and Telegram delivery are not implemented; a rule cannot name them.

The webhook posts to an endpoint configured on the server, not to a URL you supply — there is no per-rule destination in the data model. On exointel.watch that endpoint is currently unset, which means a matching rule today notifies nobody. The rule still stores, still shows as enabled, and still evaluates.

If alerting matters to your work, tell support what you need it to reach and you will get a straight answer about where it stands.