Documentation
Alerts
Alerts turn what Crowswatch observes into notifications. Every alert setting lives on the channel that will send it — so a Slack channel and an email channel can watch different things, at different severities, entirely independently.
How alerting is organised
Crowswatch uses a channel-centric model. You create a channel (a destination), then configure that channel's rules across four areas: status pages, domain health, web & API checks, and CASB. There's no separate global rule set — the channel is the unit of configuration.
Supported channels
Two channel types are available today:
| Channel | What you provide |
|---|---|
| A destination email address | |
| Slack | A Slack incoming webhook URL (and an optional #channel label) |
Create a channel
- Open Alerts in the sidebar.
- Under Add a channel, choose Email or Slack.
- On the Setup tab, give it a display name and enter its destination (email address, or Slack webhook URL). Optionally set Quiet hours.
- Configure the rule tabs (below) for what this channel should alert on.
- Click Save. Once saved, use Send test to confirm delivery.
You can enable or disable a channel at any time, and delete it from the list.
Rules per channel
Status page alerts
- Triggers: new incident, escalation, status update, resolved, and maintenance.
- Severity threshold: critical only, major and above, minor and above, or all.
- Scope: all your services, or a specific set.
Domain health alerts
- Configuration changes (optionally including detailed A/AAAA/CNAME changes).
- Expiry warnings for SSL certificates and domain registration, at thresholds you choose (e.g. 90/60/30/14/7/1 days).
- Security posture regressions (DMARC/SPF/DKIM/DNSSEC).
- Health score drops beyond a chosen number of points or below a floor.
Web & API alerts
- Alert after 1–3 consecutive failures (so one blip doesn't page anyone).
- Recovery notice when a failing check comes back.
- Slow response alerts when a check is reachable but slower than ~3s.
- An optional severity label (warning or critical) shown on the alert.
CASB alerts
- Severity threshold — alert at critical/high/medium/low or higher.
- Scope by connected application and/or finding type.
Quiet hours
On the Setup tab you can pause non-critical alerts during set hours (for example 22:00–08:00). Critical incidents are still delivered immediately so genuine emergencies aren't held back.
Permissions & limits
- Channels are per-team. Owners and admins create, edit, enable/disable, and delete them; members can't manage channels (but anyone can send a test).
- Your plan caps the number of channels and the number of alert-email recipients.
Troubleshooting
Slack channel won’t save
The webhook URL must be a Slack incoming webhook (https://hooks.slack.com/services/…). Other webhook URLs are rejected at save time.
No web & API alerts arriving
Open the channel’s Web & API tab and confirm the check is in scope and the “alert after N failures” threshold has been reached. A single failure below the threshold won’t alert.
Too many alerts
Raise the severity threshold, scope a channel to specific services/checks, or turn on Quiet hours for non-critical noise.