How Alerting Works

An alert rule that is enabled, correctly configured, and matched by real violations can still send nothing. That is by design — it is how noise is kept out of your inbox — but it is worth understanding before you conclude alerting is broken.

Reports are grouped into issues, not alerted individually

Every report is reduced to a signature: the combination of the violated directive and the blocked host. Reports sharing a signature are the same issue, however many pages they came from.

Alerting accumulates reports per signature in a 15-minute window. This matters more than it sounds: nine different violations produce nine separate windows of one report each, not one window of nine. Triggering a handful of distinct violations by hand to test alerting will not produce an alert, because no single signature reaches the threshold.

The confidence gate

When a window closes, it is scored. Only high confidence windows can trigger a real-time alert.

Confidence	Condition	Where it goes
High	Reported by 2 or more browser families, or 20+ signal reports	Real-time alert
Medium	5–19 signal reports from a single browser family	Digest
Low	1–4 signal reports from a single browser family	Digest
Suppressed	Every report classified as noise	Neither

“Signal reports” excludes reports classified as noise — browser extensions, bot traffic, and known false positives. A window of 50 reports that are all extension noise scores as suppressed, not high.

Browser diversity is the strongest signal available. A violation that Chrome, Firefox, and Safari all report is almost certainly real; one that a single browser reports a handful of times usually is not.

Low and medium confidence issues are not discarded

They are routed to your digest, which is configured per alert rule (daily, weekly, or none). If your rule’s digest frequency is set to None, these issues reach you nowhere — they remain visible on the Issues page, but nothing is sent. Every issue shows its confidence level and the reason it was scored that way.

Alert rules are per site

A rule belongs to one site. A site with no enabled rule of its own sends nothing, even for a high-confidence issue, and the issue is not held for a rule you add later — the accumulation window is consumed when it is evaluated.

If a site is producing issues and has no enabled rule, the Issues page says so. Check which site each rule targets if alerts are not arriving; a rule on example.com does nothing for app.example.com, which is a separate site.

Deduplication

Once an alert fires for a signature, further alerts for that same signature are suppressed for the rule’s configured time window. This stops a single ongoing violation from alerting every 15 minutes.

Why a rule might not have fired

Working through it in order:

1. The issue is not high confidence. Open it and read the confidence reason — “1 signal report from 1 browser family” is the answer.
2. The rule targets a different site. Rules are per site.
3. The rule is disabled.
4. The alert was deduplicated. An earlier alert for the same signature is still inside the rule’s time window.
5. No reports are arriving at all. See Troubleshooting — an ad blocker or a domain mismatch will produce an empty dashboard rather than an error.