The alert that fires once,
not four hundred times.
Alert fatigue is a design failure, not a fact of life. Deduplication is part of the trigger rather than an afterthought, so a beaconing host or a scanner hammering a login page produces one notification with a count, not a pager storm.
Triggers as files. Match, dedup window and the channels each one delivers to.
Three keys. Match, dedup, send.
A trigger is a condition, a deduplication policy and a list of channels. It is written in the same grammar as a detection rule, so somebody who can read a rule can read a trigger, and the two cannot disagree about what a field means.
- ▸
matchis the detection condition language, including geo, CIDR, list and threat intel operators. - ▸
dedupnames the fields that make two alerts the same, and the window they collapse inside. - ▸
sendlists channels. Adding a second recipient is adding a line. - ▸The whole finding travels so a template or a webhook body can reference any field of the original event.
One trigger. The same condition language as the rule that produced the finding.
You choose what makes two alerts the same.
Deduplication on the rule identifier alone is too coarse and on the whole event too fine. You name the fields: the same rule on the same host is one alert, while the same rule on a different host is a new one. The window is yours as well.
- ▸Multi field keys. Rule and agent, or rule and source address, or user and country. Whatever makes them the same to you.
- ▸A window, not a counter. Suppressed alerts are counted and visible, so nothing is silently discarded.
- ▸Suppression is recorded. The delivery log shows sent and deduplicated side by side, with the reason.
- ▸Bounded on restart. A trigger enabled after a quiet period cannot replay a backlog as a flood.
Sent and deduplicated, side by side. Nothing disappears without a record.
Configure a destination once. Use it everywhere.
A channel is a delivery target built from a connector and a credential. The same channel carries playbook output, alert notifications and scheduled report delivery, so adding a new Teams room is one configuration rather than three.
- ▸Email is properly formatted. Multipart with a styled HTML body and a plain text alternative, with attachments where needed.
- ▸Chat and webhook cover Slack, Teams, Telegram and any HTTP endpoint that takes a JSON body.
- ▸Built in targets open a case, raise an internal alert, or hold in the queue with no external send.
- ▸Active response runs a manager command against the affected agent as a delivery target of its own.
One channel list, shared by alerting, playbooks and report delivery.
Enable it knowing what it will do.
A new trigger is the classic way to page a team at midnight. Backtest replays the last twenty four hours of real findings through the trigger exactly as the worker would, and tells you how many matched, how many would have been sent, and how many deduplication removed.
- ▸Matched, would send, deduplicated. Three numbers that tell you whether this is signal or a pager storm.
- ▸The same code path. The backtest runs the worker matching and deduplication, so it cannot flatter the result.
- ▸Templates preview server side. What you see rendered is what the server sends, from one renderer.
- ▸Delivery is logged. Queued, sent, retried and failed, with the response from the far end.
Bring the alert that pages
your team every night.
Tell us which detection wakes somebody up for nothing. We will backtest a deduplication window against your last twenty four hours.
Powered by Codesecure Solutions. Self hosted, cloud or fully managed.