Skip to main content
Applies to BloodHound Enterprise only Alerts help you detect important conditions in your BloodHound Enterprise tenant and deliver notifications to the operational tools your team already monitors.
This feature is available through Early Access. Enable on the Administration > Early Access Features page to access it.
During Early Access, Alerts support the Collector Offline event type and Webhook alert channel.

​
Use cases

Use Alerts to keep BloodHound Enterprise events visible to the people and systems responsible for resolving them:
  • Detect important events sooner: Send an alert event to a monitored endpoint so an operations team can investigate an issue promptly.
  • Connect collector health to existing workflows: Route signed events through a generic webhook receiver that creates an incident, posts a message to an approved internal system, or starts an automation workflow.
  • Investigate delivery problems: Review delivery attempts for an alert event alongside receiver logs to distinguish a collector outage from a webhook configuration or delivery failure.

​
Key concepts

Use the following terms to distinguish the parts of the Alerts workflow:
Treat alert channels as reusable configurations, not as children of a rule. For example, multiple rules can send events to the same webhook.

​
How alerts work

You configure alert channels in Delivery, configure which event type triggers an alert event in Rules, and review alert channel delivery attempts in Event History. Each alert channel configuration has a health signal. BloodHound Enterprise updates this signal from dispatch outcomes so you can identify destinations that may not receive alerts. Health belongs to the delivery destination; it does not describe the alert event type or rule.
Your BloodHound Enterprise user role determines permissions on the Alerts pages:
  • Administrators have read-write access to all pages.
  • Auditors have read-only access to all pages.
An example Alerts workflow involves the following steps:
  1. Create a webhook on the Delivery page.
  2. Create a rule that links the webhook to an event trigger (such as Collector Offline) on the Rules page.
  3. When BloodHound Enterprise generates a matching alert event, it evaluates enabled rules, queues a delivery attempt for each configured webhook, sends the signed event, and records the outcome on the Event History page.
See Configure alerts for detailed instructions.
An alert workflow has three parts:
  • BloodHound Enterprise detects a system event or condition
  • An alert rule determines whether to notify you
  • A channel delivers the notification
BloodHound Enterprise periodically evaluates alert conditions. During Early Access, it evaluates collector check-in status approximately every seven minutes. A collector that remains offline normally causes BloodHound Enterprise to create an alert event about 20 to 27 minutes after its last check-in.
To avoid redundant alert events, BloodHound Enterprise does not send another Collector Offline event for the same collector for seven days while the collector remains unavailable. BloodHound Enterprise does not send a recovery event when the collector checks in again.

​
Next steps