> ## Documentation Index
> Fetch the complete documentation index at: https://docs.events.intrace.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> Configure alert rules and consume triggered alert rows

Alerting in the external API follows the internal physical event alert model.

## Alert rules

Rules define which threats should emit alerts.

Each rule can include:

* `enabled`
* `title`
* `severity_threshold`
* `asset_ids`
* `threat_types`
* `max_distance_km`
* `mute_interval_hours`
* delivery toggles such as `email_enabled`, `sms_enabled`, and `slack_enabled`

## Triggered alerts

Triggered alerts are persisted rows with their own lifecycle state.

Important fields include:

* alert ID
* related `threat_id`
* alert type
* severity
* state
* matched rule ID and title
* distance bounds
* created/updated timestamps

## Alert states

Triggered alerts move through these states:

* `new`
* `seen`
* `acked`
* `dismissed`

## Backfill behavior

When alert rules are updated, the internal system can backfill existing active threats against the new rules. The external API is documented the same way so clients can expect alert feeds to reflect newly-saved rules, not only future threats.