Docs Using Kumo.io
Using Kumo.io
Alerts
Alert rules watch for infrastructure changes, cost anomalies and budget thresholds, and credential health problems. When a rule matches, Kumo.io records an alert and sends it to your notification channels (email, Slack or a webhook) once, however many times the same signal is seen again.
How alerts work
Three things work together on the Alerts page:
- Alert rules decide what fires. Nothing fires until you create a rule.
- Notification channels are where fired alerts go. Channels are account-wide: when any rule fires, every enabled channel receives it, subject to the channel's own minimum severity.
- Alert events are the alerts that have fired.
A rule matches signals from three sources:
| Source | Signals about |
|---|---|
| Infrastructure Changes | Classified changes between snapshots of a workspace. See What changed in my estate? |
| Cost Anomalies & Budgets | Unusual spend and budget thresholds. See What does my infrastructure cost? |
| Credential Health | Provider credentials that stop working. See Why is my source "degraded" or "blocked"? |
Each alert fires once. If later syncs see the same signal again, Kumo.io doesn't alert again. When one sync fires several alerts, each channel gets one grouped message rather than one message per alert, and each alert is still listed and acknowledged on its own.
When a sync only adds a newly connected source's resources to a workspace, Kumo.io treats it as a baseline: instead of alerting on every resource it adds, it records a single informational signal.
Create an alert rule
Choose New Rule under Alert Rules and fill in:
| Field | What it does |
|---|---|
| Name | What the rule is called in alerts, for example "Prod sync failures". |
| Scope | Optional. Limit the rule to one workspace; by default it covers the Whole account. |
| Sources | Which of the three sources to match. None ticked means any source. |
| Minimum Signal Severity | Ignore signals below this severity. |
| Severity Override | Optional. Stamp alerts from this rule with a fixed severity instead of the signal's. |
| Kinds | Exact signal kinds to match. Empty means any kind. |
| Kind Prefixes | Whole families of kinds, such as every resource. change. Empty means any. |
| Categories | Signal categories to match. Cost signals are cost, and credential health is security. Empty means any. |
| State | Enabled evaluates every signal; Disabled keeps the rule but never fires. |
As you fill in the form, Kumo.io shows the condition in plain language.
Severities are Info, Low, Medium, High and Critical.
In the rules list, the Enabled or Disabled button turns a rule on or off, and each rule can be edited or deleted.
Add a notification channel
Choose Add Channel under Notification Channels, give it a Name, and pick the Channel:
| Channel | You enter |
|---|---|
| An Email address. | |
| Slack Channel | A channel picked from the channels visible to Kumo.io's Slack app, once Slack is connected. Without the connection, enter a Slack channel id. See How do I connect Slack? |
| Webhook (POST) | A Webhook URL. Kumo.io posts each alert to it. |
Set a Minimum Severity to send only alerts at or above that level; leave it empty for all severities. Choose Test next to a channel to send a test alert, and use its toggle to disable it without deleting it.
Channel destinations are encrypted when Kumo.io stores them.
On a self-hosted installation, email channels use the installation's email relay. See How do I configure email?
Review and acknowledge alerts
Alert Events lists fired alerts, most severe first. Filter them with Search alerts… and by severity, workspace and kind, and expand one for its detail and the rule that fired it. Choose Load More for older alerts.
Choose Acknowledge to mark an alert as seen; Reopen reverses it. Acknowledging is a display state only: it doesn't silence the rule, and if the same alert fires again it stays acknowledged.
Fired alerts also land in your notification inbox, where View All Alerts brings you back here. See How do I control what Kumo.io tells me?
Who can manage alerts
Viewing alerts needs a role that can read alerts. Creating rules and channels, and acknowledging alerts, needs a role that can manage them. See What can each role do?
From the CLI (self-hosted)
On a self-hosted installation, run these on the installation:
kumo alert history
kumo alert ack
kumo alert rule list | create | update | delete
kumo alert target list | create | deleteRun kumo alert <command> --help for each command's options. These commands don't run against kumo.io; there, use the app or the API.
Which plans include alerts
Alert rules and notification channels are part of the Business and Enterprise plans on kumo.io, and of Enterprise (Licensed) on a self-hosted installation. They aren't part of Team. See What does each plan include?
On a plan without them, the Alerts screen shows a lock instead, which explains why and opens the plan options.