Alerts
Alerts is the in-app inbox for security and discovery events raised across your organization. When a guard blocks, warns, or redacts, when a device scan turns up an AI capability nobody had seen before, or when a user requests a new MCP integration, the event lands here.
The inbox is written always, whether or not anyone is notified elsewhere. Outbound delivery — Slack, Teams, email, browser push, webhooks — is opt-in and configured separately as alert rules. That split is deliberate: your event history stays complete from day one, and you decide later who gets woken up.
The two halves
| Where | What it does | |
|---|---|---|
| Alert history | /alerts | The record of everything that happened. Always written. |
| Alert rules | Security → Alerts | Who gets told, over which channel, in what words. Opt-in. |
If alerts are showing up in the inbox but nobody is being notified, you have no rules — see Alert rules.
Where to find the inbox
Select the alert icon in the top-right of the dashboard, the siren to the left of the bell. A dot on the icon means you have unacknowledged alerts. The dropdown lists them, or shows No unacknowledged alerts when the inbox is clear.
Select View All in the dropdown to open the full page at /alerts.
The bell beside the siren is a different inbox. It opens Notifications at /notifications, which you clear with Mark All as Read rather than by acknowledging. Some events are routed there instead of here — see which feed an event lands in.
The Alerts page
The page lists alerts newest first, with four filters and a bulk action.
| Control | Values |
|---|---|
| Show | Organization + mine, Organization only, Addressed to me |
| Status | All, Unacknowledged, Acknowledged |
| Severity | All, Critical, High, Medium, Low |
| Event | Any event type from the catalog |
| Acknowledge All | Marks every currently unacknowledged alert as acknowledged, within the current Show scope |
Show distinguishes the org-wide history from alerts a rule addressed to you personally over the Willow Admin channel. Addressed to me is your own inbox; Organization only is the full org feed.
Severity matches the severity field delivered to webhooks, so an alert shown as High here arrives as "severity": "high" in the payload. A rule can override an event's default severity for your org — see severity.
The list loads more as you scroll rather than paginating.
What an alert card shows
Each card carries a title, how long ago it fired, and a description of what happened. A badge names the event that raised it, for example AI Discovery · New capability discovered. Discovery alerts list each capability found and whether it is allowed.
On the right of every card are an Acknowledge action and a delete icon. Select the card itself to open the detail panel.
Acknowledging alerts
Acknowledge an alert from its card, or use Acknowledge All to clear the inbox after triaging a burst of events. Opening an alert acknowledges it automatically.
Acknowledging clears an alert from the siren dropdown but does not remove it. Switch Status to Acknowledged or All to see previously acknowledged alerts. To remove an alert entirely, use the delete icon on its card.
Deep links
/alerts?alert=<id> opens the page with that alert's detail panel already open, and works even when the alert isn't in the currently loaded page of results. This is what the View alert button on a Slack message or Teams card points at.
If no alerts ever appear
Check both sources. All guards ship disabled, so a new organization raises no guard alerts until you enable one — see Enable a Guard and See It Fire. Discovery alerts require the scan agent to be deployed; see AI Discovery.
Related
- Alert rules — who gets notified, and how
- Channels — Willow Admin, Email, Browser, Slack, Teams, Webhook
- Guards
- Monitor Logs