Browse the docs
Concepts
Alerts
Alerts flag events a person should look at, from sign-ins on new devices to reused enrollment codes and network denials, and go to webhooks and email.
Last updated
On this page
Alerts collect events that a person should look at: something that is either expected or a sign of trouble. Repeats of the same event fold into one alert with a counter. Secret values never appear in alerts, because the server doesn't know them.
Where to see them
Owners and admins see the organization's alerts in Alerts. Filters show Open, Unread, Closed or all alerts, by severity. Each alert says What's affected and What to do. Mark as read when you've dealt with one. Some alerts that concern you personally appear under For you.
Severity is Info, Warning or Critical.
Notification channels
In Alerts, open Notification channels and choose Add channel:
- Webhook: the server sends each alert to an address you give, signed with HMAC. That works with Slack, Microsoft Teams or PagerDuty through their incoming webhooks. The Webhook signing secret is shown only once. Save it in the receiver's settings.
- Email: alerts go to the addresses you list. Email works if the server has it set up. On a self-hosted server that means
RESEND_API_KEYandALERT_EMAIL_FROM. Otherwise only webhooks are available.
Each channel has a severity threshold: Critical only, Warnings and critical, or All alerts, including info. A test button sends a test message, so you can check that it arrived.
Alerts and what to do
| Alert | What may have happened | What to do |
|---|---|---|
| New device sign-in, from a new address | a person signed in from a new computer, or someone signed in as them | ask the person. If it wasn't them, they use Device compromised… from another device |
| Enrollment code reused, or a code presented without its secret or from an unexpected network | the enrollment code was intercepted | don't approve the machine without checking its fingerprint. Issue a new code |
| New machine address, or a valid key used from an unexpected network or outside the bound CI | the machine moved, or its key is used elsewhere | if nothing moved, treat the machine key as leaked |
| CI token replayed | someone reuses a CI provider's JWT | check the pipeline. If in doubt, replace the service token |
| Repeated denials | someone probes for access, or a setting is wrong | look at that subject in the audit log |
| Lease expired | a machine hasn't contacted the server for a long time | is it switched off? If it should be running, check the agent with crunu status and the network |
| Access recovery started, keys released, access recovered | a person is recovering access with a recovery code, or someone else holds their code | make sure it's them. If not, they cancel the attempt from their account |
| Certificates expiring | certificates of members or machines end soon | an admin opens Pending actions and uses Do everything I can |
| Undelivered keys or outdated file copies | new keys or files didn't reach someone | Pending actions shows who. Ask a key holder to open the web app |
Network rule alerts
These go to owners and admins, and to channels by severity. Four of them also email members directly, if the server has email.
| Alert | Severity | What may have happened | What to do |
|---|---|---|---|
| Network policy relaxed | Warning, email to every owner | a rule or list was replaced with one that admits more addresses. It takes effect in 15 minutes, or at once with a second signature | if expected, nothing, or confirm as second admin. If not, Cancel relaxation before it takes effect |
| Fast rollback of a rule | Critical, email to every owner | an owner returned a rule or list to a version from the last day without waiting | if expected, mark it read. If not, review and tighten the rule |
| Break-glass access | Critical, email to every owner and admin | an owner opened access for themselves outside the rule, for up to 60 minutes, with a reason | if expected, nothing. If not, revoke it in Networks |
| Network denial | Critical for machines and tokens, Warning for members | a request came from outside the rule's networks: a new office, VPN or machine address, or a key used elsewhere | add your new network to the rule, or treat the key as leaked. See Network denials |
| Server doesn't see client addresses | Warning | the server couldn't determine the client address, so restricted environments are served to nobody | the server operator checks TRUST_PROXY with doctor |
| Machine pass from a new address | Warning | a machine got contents from outside the allowed networks with a machine pass | add the new address to the list, or Revoke pass |
| Machine pass used inside and outside at once | Critical, email to every owner | within 10 minutes the same pass was used from inside and from outside: the machine key seems to work in two places | check where the machine runs. If the second address isn't yours, revoke the pass and the machine |
Alerts about the rule of a personal environment are seen only by its owner.
Alerts that depend on cleanup
Some alerts come from the server's state, such as expired leases, expiring certificates, outdated file copies and undelivered keys. They appear when the server's cleanup runs. On a self-hosted server that's every minute with Docker, every 5 minutes on Cloudflare, and on its schedule on Vercel. On Cloud Run and App Runner, where cleanup runs only with traffic, they can be late. See Monitoring and doctor.
Related pages
Pending actions lists work that needs doing, such as machines awaiting approval or keys to deliver. Organization status gives a one-page summary: machines online, the key queue, outdated selected files, open alerts, expiring certificates and the last audit log check. Alerts tell you something happened. Those pages tell you what is still open.