Alerts

The Alerts page lets you configure rules that monitor your pipelines and nodes, receive notifications when something needs attention, and review a history of past alert events. Alerts are scoped to the currently selected environment.

Overview

The Alerts page is organized into four sections:

• Alert Rules -- Define the conditions that trigger alerts.
• Notification Channels -- Configure where alert notifications are delivered (Slack, Email, PagerDuty, or Webhook).
• Legacy Webhooks -- Existing HTTP webhook endpoints (shown only if legacy webhooks exist).
• Alert History -- Browse a chronological log of all alert events.

Alert rules

An alert rule defines a metric to watch, a condition to evaluate, and how long the condition must persist before the alert fires.

Creating an alert rule

Supported metrics

VectorFlow supports three categories of alert metrics: Infrastructure metrics that monitor resource utilization with thresholds, Binary metrics that fire on detected conditions, and Event metrics that fire when specific system events occur.

Infrastructure metrics

Percentage-based metrics use the conditions > (greater than), < (less than), or = (equals) against a threshold value. Binary metrics (Node Unreachable, Pipeline Crashed) fire automatically when the condition is detected -- no threshold is needed.

Event metrics

Event metrics fire whenever a specific system event occurs. Unlike infrastructure metrics, they have no threshold -- the alert triggers on each occurrence. Event rules are created the same way as infrastructure rules, but you select a metric from the Events category in the metric dropdown.

Condition evaluation

Alert rules are evaluated during each agent heartbeat cycle. The evaluation logic works as follows:

1. The metric value is read from the latest node data.
2. If the value meets the condition (e.g., CPU > 80), a timer starts.
3. If the condition persists for the configured duration (in seconds), the alert fires and an event is created.
4. If the condition clears before the duration elapses, the timer resets.
5. When a firing alert's condition clears, the alert automatically resolves.

Managing rules

• Enable / Disable -- Toggle the switch in the rules table to enable or disable a rule without deleting it.
• Edit -- Click the pencil icon to update the rule name, threshold, duration, or linked notification channels.
• Delete -- Click the trash icon to permanently remove the rule and stop future evaluations.

Notification channels

Notification channels define where alert notifications are delivered. VectorFlow supports four channel types: Slack, Email, PagerDuty, and Webhook. When an alert fires or resolves, notifications are sent to all enabled channels -- or to specific channels linked to the alert rule.

Adding a channel

Channel types

Channel routing

By default, all enabled notification channels in an environment receive every alert. To send specific alerts to specific channels:

1. Edit an alert rule (or create a new one).
2. In the Notification Channels section of the rule form, click the channel badges to select which channels should receive notifications for that rule.
3. Save the rule.

If no channels are explicitly selected for a rule, all enabled channels are used as a fallback.

Managing channels

• Enable / Disable -- Toggle the switch to pause or resume deliveries without deleting the channel.
• Edit -- Click the pencil icon to update the channel name or configuration.
• Test -- Click the send icon to deliver a test payload.
• Delete -- Click the trash icon to permanently remove the channel.

Legacy webhooks

If you previously configured webhooks before notification channels were introduced, they continue to work. The Legacy Webhooks section appears only when legacy webhooks exist.

Webhook payload

Each webhook delivery (both legacy and Webhook-type notification channels) sends a JSON POST body with the following fields:

{
  "alertId": "evt_abc123",
  "status": "firing",
  "ruleName": "High CPU Usage",
  "severity": "warning",
  "environment": "Production",
  "team": "Platform",
  "node": "node-01.example.com",
  "metric": "cpu_usage",
  "value": 85.5,
  "threshold": 80,
  "message": "CPU usage is 85.50 (threshold: > 80)",
  "timestamp": "2026-03-06T12:00:00.000Z",
  "dashboardUrl": "https://vectorflow.example.com/alerts",
  "content": "**Alert FIRING: High CPU Usage**\n> CPU usage is 85.50 ..."
}

The content field contains a pre-formatted, human-readable summary suitable for chat platforms like Slack or Discord. Generic consumers can ignore it and use the structured fields instead.

Webhook security

• HMAC signing -- When an HMAC secret is configured, VectorFlow computes sha256=<hex-digest> over the raw JSON body and includes it in the X-VectorFlow-Signature header. Verify this on your server to ensure payload authenticity.
• SSRF protection -- VectorFlow validates that webhook and Slack URLs resolve to public IP addresses. Private and reserved IP ranges are blocked.
• Timeout -- All notification channel deliveries time out after 10 seconds.

Alert history

The Alert History section shows a chronological list of all alert events in the current environment. Each row displays:

Click Load more at the bottom of the table to fetch older events. Events are ordered newest-first.

Alert states

An alert event transitions through two states:

• Firing -- The rule's condition has been met for the required duration. The alert is active and notifications have been sent to all configured channels.
• Resolved -- The condition is no longer met. The alert closes automatically and a resolution notification is sent to all configured channels.