Alerts & Notifications

Gatana can send an email or call a webhook when events in your audit log match a rule. For example, you can get an alert when a protection detects a secret or a tool fails repeatedly.

Open Alerts in the left sidebar. Only organization owners can manage alerts. All plans support rules and a preview of matching events. Notification channels require a paid plan or a self-hosted installation.

What you can monitor

Built-in templates cover these cases. You can also create custom rules with the Audit Logs filters, except date filters. Add conditions to limit a rule to a specific server, tool, user, or event.

Create a rule

1. On the Channels tab, select New channel. Add email recipients or a webhook URL, then use Send test to check delivery.
2. On the Rules tab, select New rule. Give it a name. This name becomes the notification title.
3. Select Use a template or add your own conditions. An event must match every condition. Use separate rules for alternative conditions.
4. Set the number of events needed for an alert. For example, notify after 10 events within 5 minutes. Set the minimum wait between notifications to control how often the rule sends.
5. Select All channels or Selected channels, then save the rule. All channels also includes channels that you add later.

Matching events shows counts for the last 7, 30, and 90 days while you edit. Each count links to the matching audit events.

By default, one matching event triggers an alert, with at least 60 minutes between notifications. The next notification includes events that match during this wait.

Gatana checks rules once a minute. Notifications usually arrive within one to two minutes. Rules monitor new events. Creating or enabling a rule, or changing its conditions, skips existing events.

Tool-call rules need MCP audit logging. The default level, terse, is sufficient. At off, tool-call rules cannot match. See Logging Detail.

Channels

Notifications contain the rule name, event count, time range, and a link to the matching audit events. They exclude the event details, tool arguments, and responses. The link requires a Gatana sign-in and permission to view the events.

You can test or disable each channel. Self-hosted email requires SMTP or Amazon SES.

Webhook requirements

• Use a public HTTPS address in Gatana Cloud. Self-hosted installations can also use private network addresses.
• Use the optional extra header for authentication, such as Authorization. Gatana encrypts the stored header value.
• Verify X-Gatana-Signature with the channel's signing secret. The SIEM signature verification examples also work for notifications.
• Return a 2xx response within 10 seconds. Gatana does not follow redirects. Retries can cause duplicate messages; use the notification's id to detect duplicates.

History and limits

The History tab keeps notifications for 90 days and shows the delivery result for each channel. Gatana makes up to five delivery attempts per notification and channel. After 24 hours of channel failures, organization owners receive an email.

An alert counts once toward the daily limit, even if it goes to several channels. Tests do not count toward this limit.

At the daily limit, alerts pause until midnight UTC and owners receive an email. Events during the pause remain in the audit log but do not trigger alerts later.

Changes to rules and channels appear in the audit log and in SIEM streaming.