Understanding Alerts
Alerts are at the core of Containment.AI's monitoring system. This guide explains what alerts are, how they're generated, and what information they contain.
What is an Alert?
An alert is generated when:
- A user attempts to send content to an AI platform that violates a policy
- A policy rule is triggered based on content patterns
- Suspicious AI interaction patterns are detected
Alerts provide visibility into potential data leakage and policy violations across your organization.
Alert Lifecycle
An alert is always in one of four statuses:
Open → In Progress → Resolved
↓
Muted
| Status | Description |
|---|---|
| Open | New, not yet handled |
| In Progress | Being worked |
| Resolved | Addressed and closed |
| Muted | Suppressed from the active view |
Acknowledging an alert is separate from its status: it records who saw it and when, and leaves the triage status unchanged. Assigning an alert from its detail drawer does move it to In Progress.
Severity Levels
Alerts are classified by severity:
Critical
- Highly sensitive data detected (SSNs, passwords, API keys)
- Requires immediate attention
- May indicate sensitive data actively leaving your environment
High
- Sensitive PII detected (emails, phone numbers)
- Confidential business information
- Should be reviewed within hours
Medium
- Potential policy violations
- Ambiguous content matches
- Review within the business day
Low
- Minor policy triggers
- Review as time permits
Info
Informational records rather than policy violations — for example, the first time a new AI tool is seen in your organization.
Info-severity alerts are not covered by the severity filter chips (Critical & High, Medium, Low), so find them via search or by scanning the list.
Alert Information
Each alert contains:
Basic Information
- Alert ID - Unique identifier
- Created At - When the alert was generated
- Status - Current alert status
- Severity - Risk level
Context
- Actor / Machine - Who triggered the alert
- Guardrail - Which policy was triggered
- Enforcement Outcome - Blocked, Allowed with alert, or Redacted
- Source IP and Endpoint - Where the request came from and went to (shown as "Not captured" when absent)
- Assigned to - The admin working the alert, if any
Violation Details
The policy-check service evaluates the prompt and retains violation alert metadata only — it does not store the full prompt:
- Policy Name - Which policy was triggered
- Severity - Risk level of the violation
- Violation Message - Description of what was flagged
- Matched Term/Pattern - The specific term or pattern that triggered the policy
Request Snapshot
- Sensitive fields - The matched terms or patterns, as badges
- Prompt Excerpt (Redacted) - A redacted excerpt of the submission
- Model response snapshot - A snapshot of the response, where captured
Alerts do not carry device, browser, OS, or conversation/session context — those fields are not part of the alert record. Device information lives on the Devices page.
Alert Types
Data Leakage Alerts
Triggered when sensitive data patterns are detected:
- Social Security Numbers
- Credit card numbers
- API keys and secrets
- Passwords and credentials
- Medical information (PHI)
- Financial data
Policy Violation Alerts
Triggered by custom policy rules:
- Prohibited topics
- Confidential project names
- Code or intellectual property
Shadow AI Discovery
An informational alert the first time a new AI tool is seen in your organization, recorded as Info severity with an allowed outcome.
Behavioral alerts driven purely by usage patterns — usage volume, off-hours activity, rapid consecutive requests — are not generated today. Rate-anomaly policies can be authored (see Policy Categories) and are evaluated by the policy-check service.
Alert Details View
Click an alert to open its detail drawer:
Header
- Severity, status, and enforcement-outcome badges
- The alert summary
- A click-to-copy Alert ID
Metadata
- Guardrail (policy name), enforcement outcome, actor/machine, source IP, last seen
- A score explanation for the assigned severity
Request Snapshot
- Endpoint, sensitive fields, redacted prompt excerpt, model response snapshot
Response Actions
- Acknowledge alert - Record that you've seen it (does not change status)
- Mark as resolved
- Triage status - Move between Open, In Progress, Resolved, and Muted
- Assign - Assign to an organization member (also sets In Progress)
- Create exception - Start an exception from this alert
The drawer has no status-change timeline, no notes field, and no "contact user" action. Status changes are recorded organization-wide on the Activity page under the Alert actions tab.
Alert Notifications
Alerts surface in the dashboard — the Alerts page, its queue counters, and the overview's alert card.
Outbound alert notifications are not shipped: there is no per-alert email, no daily digest, no configurable thresholds, no Slack or Teams delivery, and no customer-configurable webhooks. The Enterprise SIEM export covers audit events, not alerts — see SIEM Integration. If alert routing into your existing tooling is a requirement for your deployment, contact your account manager.
Best Practices
Triage Workflow
- Review Critical First - Prioritize by severity
- Check Context - Understand what happened
- Determine Intent - Accidental vs. intentional
- Take Action - Resolve, escalate, or dismiss
- Document - Add notes for audit trail
Reducing False Positives
- Refine the policy's keywords and patterns
- Grant narrow, time-limited exceptions for legitimate matches
- Review and adjust regularly
- Train users on acceptable use
Investigation Tips
- Look at user's full history
- Check if pattern repeats
- Consider business context
- Consult with the user if needed
Retention
Your plan's audit-history visibility window is:
| Plan | Retention |
|---|---|
| Free | 30 days |
| Professional | 365 days |
| Enterprise | 365 days (longer terms scoped per engagement) |
Related Topics
- Managing Alerts - Handle alerts effectively
- Alert Filters - Find specific alerts
- Audit Logs - Detailed event history